Good question. The downvotes are undeserved.

The reason is that if it's done in the browser then a person's preferences will apply to every website they use with that browser. Publishers will not want that as they hope that users will give them more consent than other web sites (I certainly do give some websites full permissions if I like them, others are a 'reject all' and 'object all')

Also, your consent preferences are stored under that website's cookie. There is the option of a global cookie but nobody uses it. This cookie data is then sent to everyone involved in the adtech chain (which is causing issues since it can be multiple KB's in size). It's format is described in [0]

[0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

Perhaps this is where the regulation should've been aimed at in the first place? Cookie options have been present for a long time, but they don't have the necessary granularity. This would've been a great push to update the system.

It's the website's fault, period.

They want to track you to death, and put the burden of tiptoeing the law on you.

GDPR does not require any banners or consent dialogs at all for cookies that are necessary for authentication, navigation, or keeping track of shopping cart contents in the current session, etc.

It's only the unnecessary tracking that needs explicit consent. So it's a good thing if such sites are slow to load and have to present irritating banners for legal reasons. This will hopefully put them at a competitive disadvantage compared to sites that don't insist on tracking their customers.

The page loads instantly because there's no tracking crud all over it in my experience of forcing* GDPR compatibility on clients

* sorry I meant strongly advising using legalese

P.s. I'll throw an internet party when Hotjar go out of business. Creepy fucks ruin the load time of every site they tarnish.