Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were:

* user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases

* authentication cookies, to identify the user once he has logged in, for the duration of a session

* user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration

* multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session

* load‑balancing cookies, for the duration of session

* user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)

* third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent.

[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm