It is all in the law, the problem is enforcement. 99% of the cookie banners on the web you'll encounter are in fact illegal.