> So the privacy law that is regulating tracking and data transfer - especially when ambiguous to the user - is to blame and not the companies performing these shady practices?

Yes, the purpose of the law is to end the shady practice which doesn't seem to be happening and no one is caring about the outcome. Popup seems to be just like a second ToS which existed in web for years. If the law doesn't track its real world effect or doesn't do an analysis on the benefit to annoyance ratio, yes it's the law which is to be blamed.