That's, in a nutshell, what the law says since 2018.

Whatever you see in cookie banners is either malicious compliance or directly illegal (and already being prosecuted and resulting in fines).