I'm going to repeat … cookie banners are not necessary for functionality that the user expects to receive as part of the service provided. And yes, this is part of the ePrivacy Directive. And indeed, the cookie banners that only “notify” users, without requiring an acknowledgement to proceed, are not even legal.

Go to any Mastodon website right now. Why aren't they providing a cookie banner for notifying that session cookies are used?

Go to GitHub for that matter. Why aren't they providing a cookie banner? We know why: https://github.blog/2020-12-17-no-cookie-for-you/

GDPR isn't concerned with cookies. What the GDPR cares about is personal data and having a legal basis for processing. And “consent” is only one of those legal bases.

You don't need consent, for example, for using a home address for delivering pizza, since pizza delivery can't work without that home address. That's what's called a “legitimate” interest. You also don't need consent for keeping logs for security purposes, if the retention rate is reasonable (e.g., 3 months). You also don't need consent if the law demands that you keep certain records for fraud detection by law enforcement (e.g., banking).

--->

A vast majority of websites needing cookie banners or GDPR consent dialogs are doing spyware shit, which includes Google Analytics (85% of all websites), or behavioral advertising via RTB platforms. And the few websites that don't probably haven't spoken with lawyers yet.