The main cause with the "cookie law" is that the law as written failed to implement the intent; the intent was to reduce tracking by cookies, but the actual requirement could be satisfied by those obnoxious warnings while doing tracking as before, and so it was. If the concept of "consent to cookies" was worded more strongly, as in the current laws, then many websites would actually have not made these warnings and simply made do without the cookies, since they wouldn't be able to obtain consent from most people anyway.

The new laws seem to avoid this mistake (of course, only time will tell for sure) - they are harsh enough to ensure the strategy "figure out what legalese we need to add to keep doing the same things" is not viable, and they have to actually stop gathering and using that data.

In my reading, GDPR seems like it will not enable workarounds that still allow targeting ads as optimally as they could in 2017. They'll still try to target them as optimally as they can, they'll probably figure out some workarounds for parts of it but that will by necessity be ads that are less targeted and use less private information (at least for EU residents) than last year. Also, the intent of lawmakers is clear - whatever workarounds the ad industry figures out to circumvent that intent are likely to be closed in 3-5 years with the next iteration of this directive.

The regulators are not "hoping that publishers and local companies band together, creating cookie pools and sharing user information amongst themselves" - they are explicitly creating conditions to ensure that it's almost impossible to get consent for that sharing of user information, and also that Facebook and Google will be able to get much less information than they could before - for example, the GDPR has a big impact on information gathered by all the FB like buttons and google analytics snippets in third party websites; and the "4% of global turnover" clause is included explicitly so that it has leverage to force Google and FB to change their behavior (at least for EU residents). There's no such thing as a "service-wide" opt-in for everything anymore; I will be able to deny Google consent to use my gmail data for targeting ads on google.com, and Google will have to obey; I will be able to ask Facebook for the data they've gathered about me on third party websites and get them to remove that data.

Since it's expected that most EU consumers will not give that consent (why would they?) it will pull Google and FB down to the level of those ordinary publishers; they will lose the data that historically gave them this advantage. They're not hoping that EU companies will magically grow new revenue streams, they are taking away those revenue streams (regarding EU customers) for all companies, EU and foreign.

This seems like what the regulators are actually expect to happen, and from what I've seeing in the internal activities of local businesses, it's going to happen - pretty much everyone here has major ongoing IT projects that will reduce the amount of private data that they are gathering and storing. That is the ePrivacy version of the crosswalk - stop gathering private data about users, anonymize/cleanse the data you already have, and do your advertising in a more coarse-grained manner.