I'd say it's definitely illegal.
Here's what the cookie notice says on Facebook at the time of writing this answer:
By clicking on or navigating the site, you agree to allow us to collect information on and off Facebook through cookies.
And here's what the GDPR define consent:
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Also consider this, by the way:
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
I tried this. I opened my browser in private/incognito mode, so it should not use any previous cookies. On Google, I searched for "facebook John Doe". Clicked on a result bringing me to a Facebook page with a list of profiles of people named John Doe. The cookie bar appears at the top, but let's pretend I did not notice it. Then I click on a profile, supposing I'm interested in a certain John Doe, and... I land on John Doe's profile on Facebook, now without the cookie notice! What happened is I gave consent by clicking on any link, that is, clicking on John Doe. I can't see any way this "consent" could ever be considered "freely given, specific, informed and unambiguous indication of the data subject's wishes".
Why is Facebook not compliant? Well, they probably couldn't be compliant even if they wanted to, unless they wanted to go out of business. Lately I've been wondering what the purpose of Google Analytics would be if users were always given the option to freely refuse consent. Virtually every user would always be clicking on "I don't accept", every time everywhere, so lots of business models would be totally disrupted. By the way, as of now, the cookie bar of this community (stackexchange) does not comply with GDPR either. To tell you the truth, I'm afraid very few websites have a GDPR compliant cookie notice.