This is because the law should say "The only circumstances in which you can get your users PII is when they willingly give them to you, as clients/subscribers. The only circumstances you can sell that data or track your users is never".

Instead we tried something that look like a punt, and even then tracking/adtech ghouls aren't happy. I say we should lobby hard to get my version at least examined in the EU parliament (or in any parliament in a EU country, really), that will probably scare them into removing the cookie banners.