So there's the old e-privacy directive which I agree was poorly thought out, but cookie banners in their current form were implemented by companies as a reaction to GDPR which has no thoughts on cookies - fingerprinting is equivalent to cookies under the GDPR.