There's your mistake. It's not approved. The EU literally sued them for coming up the bullshit banner: https://www.euractiv.com/news/top-eu-court-finds-widely-empl...
It's in the name: IAB stands for Interactive Advertising Bureau. They couldn't give two shits about your site. All they care is about testing the limits of the law to get their hands on any and all user data.
Their banners originally were explicitly illegal: https://noyb.eu/en/where-did-all-reject-buttons-come (this describes mostly OneTrust banners, but IAB's banners were the same) and https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumb... (IAB's banner turned your "no to tracking" into "yes to tracking")
> So in my opinion, despite originally being well intended, GDPR opened a huge can of worms, created a lot of issues and made everyone's life harder on the internet, for no real benefit.
Translation: shitty businesses made life of everyone harder on the internet and blamed regulations for their own behaviour. From IAB (and OneTrust and Admiral and other scummy greedy leeches') banners to idiots at companies who assume that data on their customers is no longer needed to ... provide services to those same customers.
Yes, it exposed a can of worms. Worms decided its their god-given right to stay.
One day I got a letter from the national authority regarding personal data where I was asked to reply to 15 questions regarding a personal project of mine, invoking the GDPR. The sanctions for not complying within 5 days was an incremental fine of 600 euros PER DAY, until I complied. This letter was directed to me as a natural person (not even my company).
Another story: I had a publishing website with some ads on it. The moment full GDPR went into effect, some years ago, revenue instantly dropped by 30% because the cookie banner I was using wasn't part of the approved european framework for cookie banners (they created an entire organization for this, called IAB). Most of the "approved" cookie banners are insanely overengineered nonsense and almost all of them cost a lot of money. And they kill your performance metrics. And when I finally gave in and implemented one of those, revenues dropped even more because I was losing readers who just quit without consenting at all.
So in my opinion, despite originally well intended, GDPR opened a huge can of worms, created a lot of issues and made everyone's life harder on the internet, for no real benefit. On the contrary, the large companies could afford the legal counseling that they needed, but the smaller ones were hit hardest.