The EU has ruled that consent for tracking (including cookies) has to be given with an unambiguous voluntary assent — "scrolling implies consent" does not qualify.

This is clearly the right decision about interpreting the GDPR, but it doesn't addresses the weak points of the GDPR. Basically, it is too easy for practical pressure to convince people to "voluntarily" accept collection of data that should not be collected at all.