Legality at the root is what a nation or union of nations is able to enforce. Perhaps GPDR is not legal in the case law, but I see cookie banners on most sites I visit these days.