GDPR is about data collection, not about cookies.
Using cookies for core functionality instead of tracking does not require consent. Tracking without cookies does require consent.