Instead, mandate a standardized header to communicate the intent, as most users have the same intent on all sites.

Show a cookie popup to a user who already said no via the header? That's a fine. Do it again? There goes 2% of your annual revenue.