The concepts of a session cookie is different then a cookie used for advertisemnet that tracks you across the internet. The problem is tracking and ads, not authentication and authorization for functional purposes. Cookies are just one way to track people and serve ads, there are many others.

Facebook is a great example on keeping diluting these concepts. They ask for your information for function security purposes and then go back and use that same data for ads - that is unethical and has to stop.

Which is irrelevant, because session cookies don't need a warning. There is no reason to equivocate session cookies with tracking cookies.

Cookies are allowed, tracking users without consent is now illegal in EU (regardless which technology is used).

The GDPR doesn't regard cookies that serve a bona-fide business purpose. You are free to use cookies to provide a shopping cart, or allow users to log in to an account at your store, or whatever. It's specifically tracking and advertising that is forbidden.

If the user is not getting something out of it (besides the generic "access to my website") then presumptively don't do it. GDPR is literally as easy as that.

GDPR understands full well that you need session cookies to provide a shopping cart or user account. That's why there's specific exemptions for it.

Define "a lot of normal web stuff". How did we ever do normal web stuff before session cookies?

I mean, we have had session cookies since the first version of netscape. Almost everything we think of as 'normal web stuff' is post cookies.

We telnetted into places.

Session cookie in the URL?

I think they would start another fire, and get another blanket

We didn't