I always read this as: "Our European visitors are important to us BUT vacuuming all your data and selling to multiple bidders is importanter " You wanna be obnoxious? Sure, go ahead, but I'll dislike your site more (and I have adblock so I have no qualms in accepting). Wanna pretend you're compliant by having an obvious non-compliant "solution" and think that will shield your responsibility? Now I'll just hate you an…
--------------
Hypothetical conversation with a Malicious Advertising Website:
MAW: Can I stalk my users without telling them?
GDPR: No, you must have consent to track users.
MAW: So I can assume I have consent because they're using my site?
GDPR: No, the consent must be explicit.
MAW: Got it, I'll put it somewhere in the fine print of the terms of service.
GDPR: Uninformed consent doesn't count. Fine print doesn't count as informing users.
MAW: Okay, so I'll have a banner with an obvious "accept" button and several hidden steps to opt out.
GDPR: Nope, it must be just as easy to retract permission as to grant it. If it's a single step to accept, then it must be a single step to reject.
MAW: In that case I'll have the "reject" button kick them off the site.
GDPR: Consent must be freely given, and having a service be conditional on consent is coercion. Consent to track may only be given as a gift, and not as an exchange.
MAW: WAAAH!! This is so hard!!
---------
Hypothetical conversation with a Non-Malicious Website:
NMW: I don't track any information about visitors to this site, and only serve non-targeted advertisements.
GDPR: Sounds good, go right ahead.
NMW: Say, I want to make a "To-Do List" site. Do I need to warn users that I'm going to remember the to-do items for them?
GDPR: Nope, no issue there. That's necessary for the service to function.
NMW: Huh, this is really simple.