I'm not sure GDPR applies if they're not using any third party services. That's the thing with GDPR compliance, if you're already doing things right it doesn't

I'm not sure GDPR applies if they're not using any third party services. That's the thing with GDPR compliance, if you're already doing things right it doesn't really change anything, you don't even need to ask about cookies (because cookies are actually ok under GDPR if they're used the way they were originally intended.)