This doesn't sound very GDPR-compliant, but the GDPR provides insufficiently concrete guidance.
Consent as defined by the GDPR must be freely given. If dark patterns are applied to coerce the user towards giving consent, this calls into question whether the consent would be valid. For example, nagging the user with a popup on each page might not be compliant. Instead, the website should remember the consent status (whatever choice the visitor made), and revisit this consent status regularly. For example, a site might ask the user every couple of months whether they've changed their mind.
The GDPR does say that withdrawing consent must be as easy as giving it. But it doesn't say anything about declining consent in the first place. In practice, this requirement together with concerns about free decisions means that supervisory do expect declining consent to be as easy. For example, if a consent dialog has an “accept all” button, there should also be a “reject all” button.
Sometimes, repeated consent nagging is motivated not by malicious intent but by a misunderstanding of cookie consent requirements. The cookie consent requirement stems from the 2002 ePrivacy directive. It says that access to or storage of information on the end user's device needs consent, unless that access/storage is strictly necessary for a service explicitly requested by the user. Cookies and similar technologies store information on the end user's device, so that consent is needed for all non-essential cookies.
But this also means that no consent is required for truly essential cookies, such as for implementing browser sessions, security tokens, storing user preferences, and storing cookie consent. When the user decides to decline cookie consent, it is still permissible (and arguably even mandatory) to set a cookie to remember that decision.
Responsible for collecting consent is the “data controller”, but in some situations there might be multiple data controllers making responsibilities murky. However, case law such as from the Fashion ID case clearly show that the website operator is a data controller for everything that happens in the website, so they can always be held liable. If the website operator shares personal data with third parties, the operator needs a legal basis to do that – often, consent. It is the website operator who decides whether to integrate a third party tool, so the website operator is responsible for having a legal basis for resulting data sharing. However, the website operator is not necessarily responsible for what the third party subsequently does with the personal data.