It's already the case that necessary cookies don't need permission, but websites do not abuse this to not show the prompt. This is because the legislation has teeth.