And in the latter case, they could even not put any banner at all and still be compliant. The GDPR requires consent only for tracking.