It's easy: if you as a website owner transfer personally identifiable information to a third party and it's not strictly necessary to provide your service, then you need consent from the user.
If you would refrain sharing that info, you wouldn't need to ask for consent.
There is no law that asks for cookie popups
I would like more sites asking consent when passing info to a 3rd party becomes necessary (in relation to a requested service, like when you use location services in a phone app, for example) instead of asking for bulk consent for the whole site visit.
Probably built by a web gency who added tracking, perhaps even GA, so there was need for a cookie pop up banner. Why that website would need tracking and profiling is beyond me.
I think every website should understand how and by who their website is used. I don't consider this "spying." If you walk into a brick and mortar store the shopkeeper has every right to count that you came in, and watch where you go in the store to optimize it. The web should be no different.
Fortunately there are in fact cookieless analytics systems that people can use to get this information why not being required to have the stupid cookie popup.
Yes, a brick and mortar store can absolutely profile you without consent if they wished, and so can a website. The only condition is not collecting PII.
FWIW I am a website/webapp owner and use zero third party cookies or services, not even first party tracking (apart from analyzing web server logs from time to time).
Still, the GDPR obviously had some "bugs" which let companies get away with basically showing you "we're tracking you, click OK". Which is a waste of time for the companies and users and doesn't improve users' privacy in any way. So, it was a faulty law that caused damages
Your first paragraph describes GDPR, which does not require cookie popups.
But there is also the e-privacy directive (older than GDPR) that does require a cookie popup for any cookie not strictly required to deliver the service. Regardless of whether it tracks PII. So this also applies if for example you only want to know whether someone is a returning visitor or a new visitor without storing any identifier.
If you would refrain sharing that info, you wouldn't need to ask for consent. There is no law that asks for cookie popups