The problem is rather, that they didn't decide yet (e-privacy directive). The gdpr was meant to be general, it was designed to not have technical details because it applies to everything.
It's noteworthy that in the Sephora case for California the AG explicitly called out the Global Privacy Control (gpc) as something that companies need to honor.
From https://oag.ca.gov/news/press-releases/attorney-general-bont...: "“Technologies like the Global Privacy Control are a game changer for consumers looking to exercise their data privacy rights. But these rights are meaningless if businesses hide how they are using their customer's data and ignore requests to opt-out of its sale,” said Attorney General Bonta. “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable."
