Most doesn't event know what cookies too. In fact, most doesn't put extra thought into the things they are clicking/accepting on web.

Because of this, I found it odd that the regulation allows displaying the accept cookies button. Instead, it should be rejecting cookies by default and a separate flow to accept tracking cookies (e.g. via account settings page)

Why not have all tracking disabled by default by law and have users opt in through Settings menus?