IANAL but the legal advice at my last two places was that cookies that were necessary for the functionality of the product and its features were exempt from opt

IANAL but the legal advice at my last two places was that cookies that were necessary for the functionality of the product and its features were exempt from opt-in consent under both ePrivacy and GDPR. This includes sessions and preferences. Cookie banners on page load are not necessary for consent. The user can provide consent at the point of enabling the feature or setting. Of course, non-exempt cookies can not be stored until consent has been obtained.