Comment by jamiecurle

technically, it's the ePrivacy directive. GDPR requires the consent to process personal data and governs the data but the ePrivacy directive is the instrument that requires that god-damn-please-make-it-stop-banner.