[tripzilch]

> It's not allowed to keep state of the user without asking (under GDPR).

False. You're not allowed to store data about the user for any amount of time longer than is required to provide the session/service.

Session cookies are explicitly allowed without consent. Even though many cookie consent popups imply that they are not ("cookies are required for this site to function"), that is a lie by the adtech industry (and ignorant webdevelopers).

Remember: They are NOT asking for permission to store session cookies--they don't need it. Every cookie consent popup is literally asking for permission to share tracking data with third parties. Even if they word it obscurely.