The technical means that you use to accomplish tracking doesn't matter at all. Even server-side storage is covered. Storing a cookie that says the the user opt

The technical means that you use to accomplish tracking doesn't matter at all. Even server-side storage is covered. Storing a cookie that says the the user opted out of tracking is perfectly fine. GDPR isn't about cookies. It's about tracking of personal information.