Functional cookies like this are exempt from GDPR's opt-in requirement
* user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases
* authentication cookies, to identify the user once he has logged in, for the duration of a session
* user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
* multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
* load‑balancing cookies, for the duration of session
* user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
* third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.
This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent.
[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.