Which it admits directly when you click the cookie banner button labeled “Customise settings”: you are presented with four yes-no toggles, the first of which is labelled “Strictly Necessary” and which can’t be disabled.
IANAL but from what I’ve been told the SO banner isn’t even GDPR compliant because it makes it harder to reject unnecessary cookies than to accept all of them.
That tells me that they don’t know. Making every part of the org prove that they aren’t is very expensive but doesn’t improve the service.
If they apply that as on and everything else in that popup as off, they are in compliance with GDPR without having to show the popup.
Unless that setting is misleading, but then they are not in compliance even despite showing the popup, even if they fix the problem I raised previously.
GitHub doesn’t have one. HackerNews doesn’t have one. The requirement is to get consent for unnecessary data processing, and most of the popups don’t even meet the requirements of GDPR to be non-coercive.