They are not forced by law, they are actually entirely unnecessary, and the ones nagging you are probably not following the law, since GDPR says that saying "No

They are not forced by law, they are actually entirely unnecessary, and the ones nagging you are probably not following the law, since GDPR says that saying "No" should be as easy as saying "Yes". There is a way to shortcut this: Do-Not-Track header. But nobody follows it. There is also GPC (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) but browsers need to implement it. There are also several other ad-hoc ways of shortcutting it, like third-party cookies, for example. But that cookie would only allow "shortcutting" the "no" answer, not the "yes". So companies simply don't implement it. There is also the possibility of not tracking at all. So the ball is entirely on the businesses' court. The law is fine actually. The only issue is that it's not strict enough.