Cookie consent popups are not mandated by the GDPR (the EU privacy law), they’re just a stupid (and often infringing) reaction to it.
The GDPR disallows tracking without consent, but more in the spirit of “don’t track” than “get consent”. It also specifies that conditions should be clear, and that not granting consent (or withdrawing it) should be as simple as granting it. It even specifies that sites that request private information from kids should be clearer, because they need to understand what they’re accepting even if their guardians will provide the consent.