The GDPR doesn’t make it a legal obligation to allow them to be disabled. It makes a legal obligation to be disabled by default (opt-in), and to be as easy to reject as they are to accept (as in, no hidden reject button, no button with a lower contrast than the other, and everything on the first popup without having to go in specific menus to find the buttons). Obviously, almost no website in the world follows those requirements, but just allowing things to be disabled is still illegal.