The GDPR isn't about cookies, it's about personal data. You can still use cookies for functional stuff, like keeping track of the shopping cart on the client.

The problem here is that companies have an ingrained culture of taking the easy route and just grabbing all the data they can without regard to privacy, which now comes back to bite them.