I thought this article was a good, brief discussion on cookie banners. The summary is that the EU didn't mandate cookie banners, just acquiring consent. And they forbid common dark patterns making the "no" option more difficult to submit. It's the tech industry that settled on the terrible banners, and many of them (most?) don't actually conform to the law's requirements.