Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important coo

Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important cookies (like a shopping cart) are usefull so GDPR don't apply. Basically, if you don't sell your user data and process it for your own services, you can recolt almost whatever you want, even PII like ip adresses