If the site is GDPR-compliant, they are not allowed to set any cookies until you click the accept button. But, a ton of sites and ad agencies are not. For example, Russians commonly just put a “we tracking you, deal with it. [OK]” banner, thinking they are funny, when it’s clearly illegal even by Russian law, but they are shielded from it by responsible officials incompetence. Same story in the US, I believe.
If the site is GDPR-compliant, they are not allowed to set any cookies until you click the accept button. But, a ton of sites and ad agencies are not. For example, Russians commonly just put a “we tracking you, deal with it. [OK]” banner, thinking they are funny, when it’s clearly illegal even by Russian law, but they are shielded from it by responsible officials incompetence. Same story in the US, I believe.