This is a real problem, but it has gotten quite silly at this point. A user agent can reject cookies by merely not doing anything with them. A user agent can signal that it accepts cookies by just retaining them.
You might argue that we could save a pittance in bandwidth by eliding the Set-Cookie header entirely. However, the potential savings here is a drop in the bucket compared to the ocean of javascript to handle the consent banners.
> Similar to the Do Not Track header, a Accept Cookies header?
Do not track can do that, it has three possible values.
0: The user prefers to allow tracking on the target site.
1: The user prefers not to be tracked on the target site.
null: The user has not specified a preference about tracking.
The problem is that DNT is mostly ignored, and also deprecated by now.
I am not a lawyer or a GDPR expert, but I think that probably wouldn't satisfy the intent of the GDPR any more than current browser capabilities to accept or reject third-party cookies would.
Contrary to ad-blocking where the website very much wants you to see ads, and is not going to help you in blocking them, this is a situation where they might be interested to help.