The cookie disaster is thanks to the ePrivacy Directive, which came before GDPR:
- https://www.edps.europa.eu/data-protection/our-work/subjects...
we could have settled on privacy compliant tracking without cookies, which is possible or use browser preferences and respect those (which would be perfectly legal)