Perhaps the people telling you 'can't do anything about it' need to do a bit of online searching.
There's always Stackoverflow if your IT bods aren't really bullshitting you to this degree and just don't know what they're doing.
To be fully GDPR compliant, you need to have a working show reject all button showing and no preselected acceptances. Which you don't. Presumably, the IT bods will have signed a contract guaranteeing that they will assume full responsibility in the event of a fine or other expenses arising from this breach?
The ICO don't think it's impossible to do something that reduces the value of your data harvesting
ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/
Please note 'You must ask people to actively opt in. Don’t use pre-ticked boxes, opt-out boxes or other default settings. Wherever possible, give separate (‘granular’) options to consent to different purposes and different types of processing.'
So set the granular options to default as no. Problem solved.
ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/
Being able to flog the data isn't a legitimate interest.
ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-we-comply-with-the-cookie-rules/#comply15
'Recital 32 of the GDPR also specifically bans pre-ticked boxes – silence or inactivity does not constitute consent.
In respect of cookies, this means that:
the user must take a clear and positive action to give their consent to non-essential cookies – continuing to use your website does not constitute valid consent;
you must clearly inform users about what your cookies are and what they do before they consent to them being set;
if you use any third party cookies, you must clearly and specifically name who the third parties are and explain what they will do with the information;
you cannot use any pre-ticked boxes (or equivalents such as ‘on’ sliders) for non-essential cookies;
you must provide users with controls over any non-essential cookies, and still allow users access to your website if they don’t consent to these cookies; and
you must ensure that any non-essential cookies are not placed on your landing page (and similarly that any non-essential scripts or other technologies do not run until the user has given their consent).'
Oh, and for everybody else, the information they scrape before you go through all those illegally preselected options is kept. Unless it's actively removed.
Something else for IT to do once they've stopped taking the piss.