The best ones are the ones without a cookie banner because they only use cookies that don't need consent, i.e. the strictly functional ones. One issue I do see

The best ones are the ones without a cookie banner because they only use cookies that don't need consent, i.e. the strictly functional ones. One issue I do see with GDPR (or its consequences) is that a market participant that only sets those strictly necessary cookies actually now gets viewed by some as iffy, because they don't ask for consent. Basically, the industry standard of treating users (paying or not) like shit has normalized this sort of abuse/harassment so much that "the good ones" stick out in a bad way. None of which is meant to discredit GDPR though. If anything, I'm looking forward to more case law like from last year in Germany, where a dark-patterned cookie banner was ruled to be so misleading that it didn't constitute informed consent anymore. The GDPR is lacking enforcement, if anything.