So yes - the GDPR is confusing as hell!
You either have to pop up for explicit consent or are not supposed to yadda yadda.
The average user is relatively sick of the GDPR I think that this point.
AFAIK, you can use cookie banners, but opting in has to be as easy as opting out. The .eu sites do that.
The same thing is true across the GDPR... I'm more familiar with the academic literature around whether there is a "right to an explanation" for AI systems embedded in the GDPR, for example. There are dozens of academic papers arguing both sides of that specific question, with no clear conclusion or consensus.
The thing is that the _intent_ of the law is very clear. You could search for loopholes and come up with all kinds of creative solutions to go around it, but then you can't pretend it is a decision you made in good fate.