It's important to point out that it's actually not at all about cookies. It's tracking by using information stored on the user's device in general that needs to

It's important to point out that it's actually not at all about cookies. It's tracking by using information stored on the user's device in general that needs to have consent. You could use localStorage for the purposes of tracking and it still needs to have a popup/banner. An authentication cookie does not need a cookie banner, but if you issue lots of network requests for tracking and monitor server logs, that does now need a cookie banner. If you don't store anything, but use fingerprinting, that is not covered by the law but could be covered by GDPR afaiu