GDPR consent should be mandated for, added, and enforced at the browser level. Not a different popup for every website, but some way for the website to include some JSON say and have its rules shown in a browser native UI.

And once set, the browser should pass the user decisions to the website, and enforce those that can be enforced locally (at the browser level).