The massive debate is either because of people misunderstanding the rules despite them seeming very clear (functional cookies are allowed and don't require consent/disclosure, and the GDPR is more about just cookies so local storage or browser fingerprinting is also covered so you can't just stalk users without consent because you don't use cookies) or because these people's livelihood depends on being in breach of the GDPR so they try to justify their behavior or spread misinformation.