Ideally browsers would have an API to handle GDPR requests natively, the way they do for hardware access, and users would be able to set the default level of access, as well as lists of exceptions for some domains. Of course, Google will never provide such API in Chrome as it would be bad for their core business of spying on people in order to sell them more stuff.
Not much has changed since browsers had to remove the capability to create popup windows (and pop-unders, which only existed because users were getting too proficient at the game of whackamole). At every single step, the industry has shown it will only behave anywhere near reasonably when externally forced to do so.
DNT should have solved this problem, but the leopard couldn't change its spots, and used it to further its attacks on users instead.
And this is why we have over-reaching regulation. Not because we want it, but because we earned it.
