In reply to Brian77.

And to be fully 100% GDPR compliant it all has to be opt-in by default. Those cookie banners that say 'we use cookies' are supposed to say 'do you give us permission to set cookies?'

I have been saying this^ for at least a year, 6-9 months publicly, and few are yet ready to realise or accept the full implications of GDPR. It is impossible to have a web presence and be 100% GDPR compliant without also being 100% in control of the data flow and data storage. Very few website owners/managers have that level of control. For this reason one can only advise people to be as compliant as they can be. The Internet will catch up eventually.

GDPR can be interpreted in 2 ways, at least. It will be left to the courts to decide how GDPR holds up and is applied.