Earlier quoted context omitted.
IIRC: At least in Europe, they needn't ask for essential cookies. They need to ask for cookies used for tracking, profiling, fingerprinting and consent to share collected info with third parties. The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and…
That‘s what I thought. I just started a prolonged burnout vacation. How do I hold them accountable / sue them? I will look it up.
The best you can do is to complain to your country's data protection agency (in the UK this would be the ICO, in France the CNIL, etc). The problem is that they aren't enforcing the regulation enough to deter non-compliance. It's cheaper (in fact, free most of the time, the worst you will get is be asked to get into compliance despite breaching the regulation for years) to breach it for as long as you can than to respect it.