Cookie banners aren't required per-se, and when the website wishes to do tracking that would require consent under the GDPR, the regulation mandates that the consent prompt should be clear, opt-in (aka pre-ticked checkboxes aren't allowed) and that accepting should be as easy as declining (so if opting in takes one click, so should opt-out).

The problem is that the GDPR is not being enforced seriously so these breaches of the regulation aren't being cleaned up. I'm not sure if it's malice or outright stupidity and the companies legitimately believe they are compliant (there is tons of bad and incorrect advice out there).

If you want things to change and you're in Europe, you should start by questioning the incompetence of your local data protection agency as they are the ones that have the power to investigate breaches & impose fines. In the UK, the Open Rights Group is raising money to sue our data protection agency for its incompetence/unwillingness to enforce the regulation, so maybe it's worth checking out: https://action.openrightsgroup.org/help-us-protect-your-data... (no affiliation)