The cookie banner truth: what's required, what isn't, and how to comply minimally