We don't know how GDPR works. Its structure grants immense discretion to political bodies. Given the EU is undergoing another cycle of political weakness, it would not be safe to assume anything about interpretation or enforcement.
This is a good principle for Constitutional law. It's a bad principle for general law, as it introduces political uncertainty and authoritarian risks into everything.
For example, the legitimate interest. Who determines that? The authoritaa. But then the authoritaa might approve Google and disapproves small-naughty-trackor. Both are doing the same privacy invasion. So why one gets a free pass and another is reprimanded.
Even if the current regulator (persons) are honest, they are not irreplaceable. Maybe the guy after them will be corrupt. And since there is a lot of money here, money corrupts.
So the website has to block users that don't explicitly agree, a simple statement won't do.
There are exceptions, GDPR having the notion of "legitimate interest", which many services will try to abuse, however it has a precise definition and user tracking, ads targeting, marketing, or other interests like that that don't cut it, even if by not doing so results in less revenue for the service.
The GDPR has teeth, which is why companies that have been violating user privacy are freaking out ;-)