The other thing I often see is an "accept tracking" button, and a tiny "more options" link that just goes to a page explaining how to switch off cookies on your browser. I'm pretty sure that's not OK with GDPR as well.