That, the whole pop-up idea was just copy&pasted. It's possible to make commercial websites without it when turning off tracking without logging or having to explicitly opt-in, possibly for added value. There's a lot of confusion while the law is mainly about differentiating which data is needed to operate and which is purely nice to have. That said, there are plenty of GDPR-compliant services that keep data for 10 years mostly in finance or auditing related use cases and nobody bats an eye