It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking.
I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them.
All in all, it's pretty sad.
Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
Functional cookies like this are exempt from GDPR's opt-in requirement
* user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases
* authentication cookies, to identify the user once he has logged in, for the duration of a session
* user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
* multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
* load‑balancing cookies, for the duration of session
* user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
* third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.
This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent.
[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Nobody knows how EU DPRs will define "need" and therefore, to be safe, you just always show the warning. The cost of the warning is low. The cost of being found in violation is high.
Avoiding this sort of outcome is basic stuff, law-making 101, but the EU's output of low quality rule-by-law not rule-of-law regulations makes it seem like they either don't know or don't care.
That isn't the claim. The claim is that a bunch of cookies are specifically exempt from the law and the law tells you that you don't need to put up cookie banner click-throughs. And also that everyone ignores that, and puts up the banner click-throughs anyway and then moans about EU law.