"But the cookie banners?" -
Firstly, these aren't necessary if you don't do any shady stuff OR legitimate processing the user ought to know about
Secondly, wouldn't they be a small price to pay for protection from the depredations of the data market?
Because that's what #GDPR is really about. Not red tape but protection from ruthless predators.
And it has far too many loopholes already.