Yes, I find this really frustrating too :(
> As it stands, it seems everyone is so paranoid about it that they implement popups by default.
I implemented compliance with the first "cookie law" at two different companies. At the first, all we changed was making the login screen's "remember me" tick box off by default. At the second, our sites were full of trackers, which the marketing department didn't want to remove, so I had to add popups.
I think companies are so used to tracking as much as possible, that they don't see any value in avoiding it; hence they're willing to absorb the cost of poorer UX (especially since they're not alone).
I don't know if this situation will change. It's certainly possible, e.g. if we treat data as a liability rather than an asset (which I've seen mentioned here a few times, in the wake of data breaches). I have no idea how it will play out, but at least things like GDPR are making spying more painful and costly, even if only a little bit.
Even respectable sites that I’m pretty sure aren’t doing “shady stuff” with data, like the BBC, make us suffer through multiple “consent” pop-ups. One particular BBC site I use requires clicking though 3 pop-ups before you can use the damn thing. It’s ridiculous.
If it was really meant the way you interpret it, then the law should have been more clearly written. As it stands, it seems everyone is so paranoid about it that they implement popups by default.