The request from management to engineering was "make us gdpr compatible, show that cookie banner we see on other sites or some shit", implementation details were designed by IT.
If this is the case, you need to re-asses both your work culture and 'belief' in what Google is telling you.