What I mean is a lot of sites will add tracking cookies like say through a google analytics tag before the user has actually accepted them.

Then, if the user clicks to reject cookies in the banner they remove the tracking cookies etc – but this is not compliant since if the user takes no action they are being tracked by default.