Cookies should not default to on
As I discussed in earlier posts, the GDPR and various guidance documents from regulators state that the default for website cookies should not be "on".
I was in Austria when I visited the Cnet.com website. Cnet is owned by CBS. CBS isn't a small business and should be aware of the GDPR and the discussion concerning cookies. However, somehow the default setting for cookies is set correctly to "on".