The flaw in regulation was not to respect the Do Not Track signal from the browser, that would have killed off a lot of cookie banners (and is an option that users).

But I'm guessing that it was lobbied against. Similarly, it has generated a large industry in cookie compliance services.