Best Practices for Cookie Notices

The main point about the cookie notice (under GDPR) that is ignored by smaller sites is that you need to first ask for permission, and only then store cookies. In practice, that means you have to get consent to enable Google Analytics (and similar trackers).

That's why any bigger website will have a huge popup that will require you to consent before doing anything else - they need you to consent and then they enable trackers.

Smaller websites just don't care and put a small cookie notice banner stick to the bottom, and enable GA anyway. Most users probably won't even bother to click it, as it's not disruptive. It's therefore not GDPR compliant.