GDPR merely requires you to tell EU citizens that you use tracking cookies and why you use them. That's it. No coercion, no potential lawsuits. I like tracking cookies, not because they provide me with adverts I want to see, they don't but the results are hilariously absurd. Virtally everyone automatically accepts them.
HTTP 451 used for GDPR isn't legal compliance, it's politics.