GDPR allows for essential cookies with no popup.

Implied consent is valid for most functionality, just not selling peoples tracking data or giving it to a third party who could.

Its entirely possible to have no pop-up.

Someone once told me they wanted one anyway because it made the site seem more legitimate than if I removed it (the only thing I would have needed to change was the embedded video from youtube and I could have dropped the popup. Oh well).