It's not the law that's the problem (well, ok, it is perhaps poorly structured to even allow these things to happen...) but in the end it's malicious compliance of all those sites that put up the banners. The law doesn't require banners. Just don't set any cookies unless they're fulfilling a user intent (such as logging in or a shopping cart), those don't need explicit opt-in.