The cookie disaster is thanks to the ePrivacy Directive, which came before GDPR:

- https://www.edps.europa.eu/data-protection/our-work/subjects...

- https://en.wikipedia.org/wiki/EPrivacy_Directive

we could have settled on privacy compliant tracking without cookies, which is possible or use browser preferences and respect those (which would be perfectly legal)