The cookies are just one outward sign of data collection. GDPR isn't about cookies, it's about collecting, storing and transferring data. Done properly, GDPR n

The cookies are just one outward sign of data collection. GDPR isn't about cookies, it's about collecting, storing and transferring data. Done properly, GDPR notices should allow users to opt in to having data about themselves collected by the interested company (and other things like acknowledging the relationships and responsibilities formed by that consent - like requesting deletion and having it honoured). We just happen to use cookies to do much of that collection. We also already had "the cookie law", so it seems "pragmatic" to piggy back the two things, for the sake of "user convenience". GDPR creates responsibilities and guidance on all the database tables, the system designs, the job descriptions and so on which operate around data about people.