The GDPR doesn't regard cookies that serve a bona-fide business purpose. You are free to use cookies to provide a shopping cart, or allow users to log in to an account at your store, or whatever. It's specifically tracking and advertising that is forbidden.

If the user is not getting something out of it (besides the generic "access to my website") then presumptively don't do it. GDPR is literally as easy as that.

GDPR understands full well that you need session cookies to provide a shopping cart or user account. That's why there's specific exemptions for it.