Imagine how many meetings there have been where companies have decided to violate the GDPR by various half-assed implementations of cookie banners.

I'm guessing people here on HN have been in such meetings. How does that discussion actually go? "We could put up a clearly compliant 'Reject all', but it would hurt our bottom line too much, so what can we do instead"?

Also: it's interesting to see the design of the OneTrust tool that (apparently) is popular for creating a cookie banner. It seems like a hundred options, where most combinations would form non-compliant solution, and are only there to give sites the ability to trick users by dark patterns. E.g. why would "Show reject all" even be an option? Who actually needs help from a third party tool to be not-quite-compliant?