[rlpb]

> I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info).

Setting a cookie is not in itself a GDPR violation. Collecting personally identifiable information is. You can collect unique visitors by setting a cookie but without collecting personally identifiable information, so no consent popup would be required for that:

1. Set a "site last visited: <date>, <serial-of-the-day>" cookie if it is not set.

2. Count hits as appropriate by examining the cookie - without collecting IP addresses.

Since no personally identifiable information is being collected with this scheme, consent is not required.