So yes - the GDPR is confusing as hell!
You either have to pop up for explicit consent or are not supposed to yadda yadda.
The average user is relatively sick of the GDPR I think that this point.
AFAIK, you can use cookie banners, but opting in has to be as easy as opting out. The .eu sites do that.
The same thing is true across the GDPR... I'm more familiar with the academic literature around whether there is a "right to an explanation" for AI systems embedded in the GDPR, for example. There are dozens of academic papers arguing both sides of that specific question, with no clear conclusion or consensus.
The thing is that the _intent_ of the law is very clear. You could search for loopholes and come up with all kinds of creative solutions to go around it, but then you can't pretend it is a decision you made in good fate.
There's also the reality that different DPAs have different interpretations of what the GDPR requires. In the linked article, Max also acknowledges this: "We need clear pan-European rules. Right now, a German company feels that the French authorities’ interpretation of the GDPR only applies to France, even though they operate under the same law within the same European market."
This may be an unpopular take, but Noyb is essentially harassing hundreds of companies with his organization's particular interpretation of the GDPR. Wouldn't it be more appropriate to first push authorities to develop common, clear, technically detailed, and legally binding interpretations of the GDPR, rather than going after companies to take action in what is still a grey area? It's not even clear at this point that the changes Noyb is pushing for are either legally required or, on the flipside, legally sufficient.