So the moral of the story is to use passive fingerprinting that is able to identify and track individual users, because then you can skip the cookie banner and be compliant with the law?

I think I would rather use this and rely on the courts to interpret it fairly if it ever came to that, which it won't.