I know one place where they were forced to add a cookie popup as part of a GDPR compliance tickbox exercise. The kicker? They didn't have any cookies. After a

I know one place where they were forced to add a cookie popup as part of a GDPR compliance tickbox exercise. The kicker? They didn't have any cookies. After a fruitless attempt to persuade the person working through the aforementioned exercise that you only need a cookie popup if you have cookies, the popup was implemented. Of course you need to store the user's preference. So now the site needed to have a cookie. One cookie which just stores the fact that the user has or hasn't consented to cookies.