There's only one legitimate use for them, which is for ancient corporate login workflows that shouldn't exist anymore. Every other use of them generally is just for targeted advertising, and with it sale of data, or using them for internal analytics.
Usually they don't really mention the selling data part upfront; it's hidden somewhere in the giant modals that they make you click through. There's also the related problem that Google is an information guzzler, and anything that enters it's ecosystem has a chance to get used by them for advertising, meaning that these giant modals also get shown for webpages that use Analytics. That last one is how you often see sites without ads get those giant modals.
Arguably they should've been blocked by the user agent years ago, and Mozilla has already done so. Google however cannot do so with Chrome because of their conflict of interest in the ad market; the UK has determined that if Chrome kills third party cookies, all their replacements would just punt Google into unfair competition. It's probably the strongest argument I can think of as to why Chrome should be split off from Google - a browser that cannot meaningfully protect a user against bad actors because of the operator being a monopolist bad actor shouldn't be used at all.
Mere (same site) login cookies require no modals or confirmation since the user implicitly consents to them when they authenticate (most users expect their login to be preserved when they changes pages and/or reload the site.) That said, it's still considered a courtesy/good practice to inform users before placing them regardless.
1. Because they are using GA4 feeding info to Google.
2. Because they have some advertising pixel / api set up feeding info to Meta.
I would guess sites like Hubspot, Salesforce, or Github might actually be selling data.
Legally the law is just: You have to ask for informed consent that has to be given freely for each purpose. How you ask and how you inform is not defined precisely, except for negative examples what isn't considered informed consent or freely given consent etc.
If someone just clicks "Accept All" that person wasn't informed. So cool that you made them click, but you could also just have left it away, since it didn't give you the thing the law required you to get.
That means real datahogs would probably need to inform people in a many slides long presentation or a feature length film before they could actually get even close to receiving something resembling informed consent. That is ofc totally unpractical and would hurt their business of data-hogging.
Now the EU came at this with the base assumption that prvacy is a right that needs to be protected in a way that it cannot be simply given away without informed free consent. So if it hurts databogs, that is one of the intended side effects.
If my friends Pizza place wants to put ads onto my website that is entirely possible without any tracking he can give me a JPEG or a video and I put it onto my website as static content. Just the current way of advertisements with 300+ third parties would become harder.
‘Every time you visit the Commission’s websites, you will be prompted to accept or refuse cookies.
The purpose is to enable the site to remember your preferences (such as user name, language, etc.) for a certain period of time.’
If a government has trouble complying with the “spirit” (as many people use in argument) of their own regulation then the regulation is poorly designed and not useful.
