There has been some change in the GDPR framework resulting in making the acceptance or refusal mandatory.

 
Refusal means refusing non-essential cookies (session cookies for example). For reference, this is the new framework. 

In the past I have created a plugin that take this into account (by linking a site policy to cookies policy) and this is derived from the tool_policy core plugin. This for logged in user or guest users.

I would like to port the features from this plugin into core so we can create policies that can either be accepted or refused by user so we don't need to install an extra plugin to use this feature.