There's 6 legal basis under GDPR, but that's irrelevant for cookies (or anything that allows you to store or retrieve information on the user's device, really), because they're covered by the older ePrivacy directive. If a cookie is not “strictly necessary”, consent is required.