The Irish data privacy regulator recently did a sweep of 38 Irish websites, reviewing for cookie compliance. Two-thirds of websites were found to be relying on "implied consent" and 37 were found to set unnecessary cookies on landing before consent was given. Overall only 3 websites were rated as "substantially compliant."

Further reading: https://www.dataprotection.ie/en/news-media/publications/rep...

Every site involved will say compliance is too difficult or whatever.

What I wonder is, if you're not going to bother being properly compliant, why bother adding a GDPR banner at all?

Because your boss has a boss who has a legal adviser who tells him they have to have the appearance of meeting the requirements of the law/regulators. Compliance theatre. They all know it's smoke and mirrors but it ticks a box in someone's board meeting agenda.

Because there's a huge difference between being "blatantly non-compliant" vs "properly compliant".

I suspect most sites will get a warning first. I have a website myself with Google Analytics and I've never added a banner myself, I'll wait for the warning first, and I expect my users to have blockers installed if they're privacy-conscious.

If GDPR starts to be enforced, they’ll go after the low hanging fruit first.

You don’t need to be compliant, just more compliant than the worst.