You are incorrect. The GDPR does not require consent for cookies. HOWEVER, if you are using those cookies to track or spy on me (advertisers take a bow) then

You are incorrect. The GDPR does not require consent for cookies. HOWEVER, if you are using those cookies to track or spy on me (advertisers take a bow) then you need to ask my explicit permission to do so. And so you should. (Take away your scummy business model, and you remove the need for cookie banners).