>If clicking "deny" is as easy as clicking "accept", people will mostly just do the former.
Unfortunately, I don't actually think people realize the law is on their side here. My girlfriend never clicked "Reject All" until I told her to because she thought something wouldn't work if she did that!
Your girlfriend was somewhat right though: if you click "Reject all" they cannot show you targeted ads, and will show you generic ads instead. That's why I always accept the tracking cookies, for me the price of the privacy incursion is worth seeing more relevant ads.
Unfortunately, I don't actually think people realize the law is on their side here. My girlfriend never clicked "Reject All" until I told her to because she thought something wouldn't work if she did that!