Most people miss that the Cookie Law was essentially the training phase for GDPR. It conditioned users to reflexively click “Agree” just to make popups disappear. Once that behaviour was normalised, GDPR arrived - now those same clicks legally authorise data collection and trade that used to exist in a grey area.
That's why the more logical and simpler ideas were never on the table.