> I do not want to disable all cookies, I'm perfectly happy to use credential cookies or a shopping cart

The cookie banner that you have to refuse/accept only concerns cookies that are not necessary for the proper functioning of the site. So login cookies or shopping cart are unaffected by the consent, and if your site has nothing else than this, it does not need to ask for consent.

Many sites, upon clicking reject, do not actually disable anything and simply suggest you disable cookies in your browser (sometimes with instructions).

Which is probably not legal.

Probably not. That's why we need legal enforcement, and not "users learn how to use the cookie options of their browsers" as these sites and the top level comment on this thread suggest.

>Also I shouldn't have to opt out

Actually, the law says the tracking cookies have to be opt in, which is why the pop ups are so aggressive and undismissable in the first place.

Pop-ups being aggressive/undismissable is in breach of the GDPR, so given enough enforcement the problem will self-resolve. These fines are a great first step I'd say (though long overdue).

of course. I'm complaining about the practical implementations and the suggestion to just disable cookies.

We're at the stage now where they can reasonably reliably track you without cookies. I think we need to focus more on restricting what companies can do with data than focusing on asking users permission for things. Popup-hell doesn't help anyone in my opinion.

GDPR deals with identifiers that can tie data to a single individual. Cookie IDs are just one way of doing that, true.

That's why GDPR is so powerful and a well thought out regulation. Replace the technology completely, but GDPR still applies as user-unique identifiers are still used. ex, cookie with fingerprint.js, nothing really changes. You still need to ask for consent for user-level tracking.

AFAIK, this is exactly what GDPR is doing.

GDPR works well in this direction but it still adds in the informed consent which caused alot of the popups and the original cookie law was the EU as well. Basically, the EU while making the internet better is also making it worse. But it's a process and I think GDPR is a move in the right direction.