Remove the word cookie as that has nothing to do with the GDPR. The EU rule was to prevent someone collecting personal identifying information and then sell it

Remove the word cookie as that has nothing to do with the GDPR. The EU rule was to prevent someone collecting personal identifying information and then sell it on without consent. A really simple read can be found at the ICO. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/ https://ico.org.uk/for-organisations/guide-to-data-protectio... The "cookie banner" is to work around the fact that there are 3rd parties who would have access to your information without your consent and they want it to be awkward so that you consent. If your application is a fitness tracker then of course you are going to have a lot of personal information. You are not allowed to sell it without consent, tracking in this case is selling information to Google et al. You tracking a logged in user, via a shopping cart as a cookie, does not violate the GDPR.