GDPR didnt do it, lazy site owners that didnt want to read the legislation did.

Most sites dont even need those popups, but its easier to just shove one on your site than try to understand the specific situations which do need it.

Yeah, the banners/popups aren't required by gdpr, they're the "malicious compliance" solution site owners came up with because they don't want to comply with the limitations, and make it as difficult as possible for the user not to let them.