The Irish data privacy regulator recently did a sweep of 38 Irish websites, reviewing for cookie compliance. Two-thirds of websites were found to be relying on "implied consent" and 37 were found to set unnecessary cookies on landing before consent was given. Overall only 3 websites were rated as "substantially compliant."
Further reading: https://www.dataprotection.ie/en/news-media/publications/rep...
Every site involved will say compliance is too difficult or whatever.
What I wonder is, if you're not going to bother being properly compliant, why bother adding a GDPR banner at all?
Because your boss has a boss who has a legal adviser who tells him they have to have the appearance of meeting the requirements of the law/regulators. Compliance theatre. They all know it's smoke and mirrors but it ticks a box in someone's board meeting agenda.
Because there's a huge difference between being "blatantly non-compliant" vs "properly compliant".
If GDPR starts to be enforced, they’ll go after the low hanging fruit first.
You don’t need to be compliant, just more compliant than the worst.
I suspect most sites will get a warning first. I have a website myself with Google Analytics and I've never added a banner myself, I'll wait for the warning first, and I expect my users to have blockers installed if they're privacy-conscious.