OneTrust, who seems to do a sizeable fraction, get it right on their own website. I have never seen a OneTrust dialog elsewhere have equal prominence given to the reject and accept pathways.

Nope. Apparently selling conconformant GDPR-compliance services is not against the law, only buying them is? Which makes some sense, but in any case OneTrust still sell dark-pattern banners to (at least) hundreds of websites even after a sizeable batch of them has been ruled illegal[1].

[1] https://noyb.eu/en/226-complaints-lodged-against-deceptive-c...

Scummy as that is, I don't think that providing the banners should be illegal, as otherwise it's a hop and a step to "providing software that can be used illegally is in itself illegal". Which makes text editors illegal without "safeguards" baked in.

However, if OneTrust are selling the software under the promise that if the customers configure it that way, then it's compliant, then that's some kind of misrepresentation (which is illegal, software or not). Just as if I sell a USB flash drive as an anti-5G-field dongle, that's illegal, but it'll not illegal to just sell the flash drive.