[M2Ys4U]

>GDPR is about consent

Consent is one of six different legal bases for processing personal data. Consent is important, yes, but it's not the be all and end all.

>It should even be fine as a cookie, although there have been talks about storing on a users device without consent

That will require consent, because the use of cookies is regulated not by the GDPR but by a different law (the ePrivacy Directive).

Under the ePrivacy Directive all cookies[0] that aren't strictly necessary to provide the service require consent.

[0] In fact it's even broader than cookies as the law covers storing any information on the user's device, so it includes things like the local storage API and indexed DB.