That was indeed malicious compliance at a large scale.

New regulations were drafted that required these popups to be as easy to agree as to disagree, precisely because of this.

On that note, I think the GDPR banner problem won't be solved until the UI is shown at the browser level, just like tracking permission dialogs on mobile: having the same UI for all sites would prevent tricking users into over-complicated form because at least it would be the same form everytime.

Right now, too many end users get fatigue fooled into blaming the EU rather than the companies tracking them, whereas on mobile they are aware that it's Facebook triggering the dialog, not the EU: just see how many users end up refusing Facebook tracking when they have a clear choice that doesn't push them one way or the other.

It would even help companies who currently delegate handling GDRP to thirdparty services that prey on small companies worried about being non-compliant.

My understanding of GDPR, et. al. is that you don't need consent to use cookies. You need consent to use tracking cookies, third party cookies, and any cookie that isn't essential to the use of the app.

So for me, that reads as anytime I am asked about consent, it is an admission that the site is using my data/adding cookies in a way that is unnecessary and invasive. Automatically decline!

According to my Lawyers in Switzerland, this is the correct interpretation.

I'm working at removing google analytics from my product site specifically because it means I don't need a cookie consent popup any longer, despite supporting log in (which will set an actually essential, non-third-party cookie).

That's what I was thinking, just have it as a presetting in my browser to reject all but necessary functional cookies as a header setting in requests and be done.