"didn't help" is different from "criminalised open source". If you say the GDPR mandates a cookie consent box, you're simply wrong.