Yes, but this exchange is in the context of cookies, as you brought up in your comment. And we're talking about companies maliciously complying with the cookie pop-up mechanism, are we not?

The cookie pop up is a response to the ePrivacy directive, not GDPR.