That is an excellent question, because this is indeed how it works on many sites. However, it is actually wrong. The proper way would be to have users opt-in.
In practice that's a violation of Art. 7 GDPR [0]. In particular, recital 42 [1] makes clear that consent can't be regarded as "freely given" if "the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment."
That's not compliant with the GDPR plain and simple. For example ads on a website are not required for that site to work (even if it's the only revenue), so the site cannot store data only to track users to show ads. The way a complliant site should work is it can say
"if you want to allow tracking cookies to get more relevant ads you can do so in settings".
I.e. no must be default in case of non-acceptance - and the site must still function.
Exactly. At least some site will be fined, and that news site might make a calculation that it's a better business decision to comply than keep violating the law.
How does this work in practice? Sites just say "we collect data, click OK to accept". Where's the option to say no?