The best ones are the ones that only use functional cookies until you do something active (like check "remember me" on a login page), thus negating any need for popups etc at all.

This is the correct answer. Non essential cookies should just be turned off by default and should only be enabled via normal navigation through a website. Your ‘remember me’ example is a good one. Thus, no banners are required, ever. This is the exact approach Github went with.

The best ones are the ones without a cookie banner because they only use cookies that don't need consent, i.e. the strictly functional ones.

One issue I do see with GDPR (or its consequences) is that a market participant that only sets those strictly necessary cookies actually now gets viewed by some as iffy, because they don't ask for consent.

Basically, the industry standard of treating users (paying or not) like shit has normalized this sort of abuse/harassment so much that "the good ones" stick out in a bad way.

None of which is meant to discredit GDPR though. If anything, I'm looking forward to more case law like from last year in Germany, where a dark-patterned cookie banner was ruled to be so misleading that it didn't constitute informed consent anymore.

The GDPR is lacking enforcement, if anything.

Most of those "strictly functional" cookies aren't strictly functional either.

I block ALL cookies and many of those sites with "strictly functional" cookies still function, which means that those cookies aren't necessary.

Strictly functional cookies don't mean the site doesn't work without them.

It does mean e.g. clicking "°F" every time on a weather site, because you're an American living in Europe. A strictly functional cookie could remember that choice.

My favorite was a record label with language like “I don’t want this” or something similar.