If you want to see an example of a more granular policy that the browsers (well, Internet Explorer, but it was the majority browser at the time) implemented also being ignored, see P3P: https://en.wikipedia.org/wiki/P3P

Ultimately the only cookie an users will willingly accept is the sessionid/rememberme. And the "remember me" checkbox is consent enough under the GDPR.

Behing all the legalese and marketing-speach, all the other purposes boils down to :

    - We are too lazy to setup a matomo, so we are giving google your browsing pattern. 

    - FB is forcing us, so we can pay ever so slightly less for ads

    - Google is offering to tell us your sex and age

    - If we dont track you, we will show you a viagra ad.

    - Through 4 intermediaries, we can pay this totaly-objective-blog which sent you here.

I'd love to hear from someone with a complex cookie consent pop-up, but i'd bet there is about 80% "accept all" (because the users have been trained to do it) 19% "reject all", and no-one is mixed.

So the do-not-track would have been accurate enough.

I asked this elsewhere in the thread as well, but what about tracking done through the session cookie?

e.g: Tying together two browsing sessions by one user on two different devices.