GDPR requires opt-in consent, so simply not displaying the cookie notice is functionally equivalent to rejecting permission.