The regulation could have been much better though. For one, it's unclear if Google Analytics cookies qualify. Spain and Austria say one thing, The Netherlands says another, so out of an abundance of caution websites put them everywhere.

I also think it would have been very feasible for the EU to define that a browser could ask for consent once and then apply that to many/all sites by sending a header. So the popup would only be needed for people without a browser that has implemented it.

  > Spain and Austria say one thing, The Netherlands says another

I thought that it is very clear that GA cookies qualify for the banner notification. What should I be reading to hear the opposing opinion?

The Dutch privacy authority claims that a consent popup is only needed for tracking cookies, and cookies with a purely analytical purpose are explicitly exempted. (https://autoriteitpersoonsgegevens.nl/themas/internet-slimme...).

Thank you

> Actually, websites could "not track"

Yes, why not stop there?

If you don't collect data you don't need to ask permission to collect data.

https://lokilist.com/about.php

Likewise, a "privacy policy" explains the extent to which your privacy will be violated.