GDPR isn't about "cookies", it's about how the website operator is allowed to abuse your personal data. Cookies are just a minor implementation detail that's only applicable to a subset of websites that don't require an account (otherwise it's stored in database).