There is no “cookie law” and no mandate that banners are used etc. Regulation should try to avoid languages in specific technology as much as possible - and the GDPR does.
There's no mandate banners be used in the same sense that there's no "requirement" bungee jumping companies have you sign a waiver; they could just make the experience inherently safer, right?
The banners were an extremely predictable outcome of a badly-crafted law.
