It may be that some sites will choose to block access to their site if the cookie isn't set.
Clearly there's no requirement to get Googlebot to tick the box as GB doesn't eat cookies.
So how do you identify a real "user"? How do you distinguish other bots from users?
Those who blindly require all users to 'tick a box or see no website' could find themselves deindexed from various searchengines.
This is a completely daft law. The requirement should have been for browser makers to build in better cookie management facilities, and better tools to set policies.