There are many legal reasons for processing personal data. Consent is one, and that's what all this is about.

"Legitimate reasons" is another. You can process personal data (use cookies) under that reason, and you don't need to ask for consent.