It's a legal requirement only if you use cookies for nefarious nonsense like ad tracking. You're allowed to store login cookies etc just fine with no need for a popup and similar purposes.
The MBAs who are drafting these requirements don't know that. They're still confused on how double chocolate chunk is making its way into a web browser. They'll always just prioritize marketing, so put the banners and who cares.