Why? Just store lists of bought product ids in its own database, then compute some statistics on it. Zero customer or user involvement is needed in that process.

So is that tracking or not? It's definitely storing personal information, so it feels like it counts, but surely the intent is for a self-contained order database to get a pass on this? Maybe not.

I think that it's a matter of implementation, because all you need really is the order correlation, not the user that passed the order. So

- if you keep a reference to specific user (like "your friend toto bought this") then you need consent

- if you keep a reference to "user category/generic profile" then it's anonymized so no need for consent

- if your profile is build on all the orders of your different users but without user informations, then it seem fine to me... because of anonymity

You don't need cookies for that

Although these things are called "cookie banner", it doesn't matter whether you need/use cookies or do it server-side. It's about the data that is being processed and the intent, not the technical implementation.

And duration. E.g. session cookie holding serialized shopping cart data is ok, but longer term storage is not ok.

It's not enough that you "want to". You have to weigh your interest and that of the users against each other and would probably come to the conclusion that you can process that data for that purpose without consent if you aggregate it.

What if you could only buy bundles of goods which are dynamically generated (and look like a basket to the user) and the seller just shows frequently purchased bundles or combines subsets of these? Curious where to draw the line.

Not at all. You don't need cookies and consent for anonymized statistics.

Then you ask for consent.