[master-lincoln]

Sometimes I think the ad industry made up the misleading term cookie-banner. At least GDPR does not limit the technology used for collecting personal information. You still need to ask for consent if you track users with some other technology. Using cookies does not require consent under GDPR, collecting and sharing PII does though (if not necessary for the service to function)

[M2Ys4U]

It's the ePrivacy Directive (and not the GDPR) that prohibits storing any data on the user's machines unless they are a) strictly necessary to provide the service, or b) the user consents.

[master-lincoln]

Thanks for the correction. But the point still stands. This isn't about cookies per se, but about not extracting value from a user beyond what the service needs when users do not consent.