IANAL caveat aside: the GDPR says sites need to ask for consent for cookies that are not needed for site functionality. These sites are not doing that, so they

IANAL caveat aside: the GDPR says sites need to ask for consent for cookies that are not needed for site functionality. These sites are not doing that, so they are violating the GDPR, but by providing a warning of what they are doing, I guess their liability might be somewhat less in the somewhat unlikely case of enforcement.