The whole cookie nonsense is not caused by GDPR at all, it is actually the ePrivacy Directive. GDPR itself only mentions cookies once and only observes that th

The whole cookie nonsense is not caused by GDPR at all, it is actually the ePrivacy Directive. GDPR itself only mentions cookies once and only observes that they can be used to profile people. It contains no instructions on what to do about that. The majority of GDPR is a bunch of mostly sensible privacy principles, such as if you manage personal data, you have to look after it well, and not use it for purposes it wasn't collected for.