A study suggests that cookie consent forms are flouting the EU’s tough data laws.