[gls2ro]

I think the assertion is correct:

IANAL:

GDPR does not require any website/webapp by default to show a popup. What GDPR requires is consent for tracking PII.

If you or anyone run a website and dont track/store/process any PII tracking information without user consent you dont need the popup.

Here is an example: Do not put any GA or tracking analytics that tracks PII on your web app and you can still have signups and login if you gave a good terms of use and you require consent for the user when they signup. You can even use cookies in the login/signup flow but use them only for making the auth work and not for tracking.

PS: If you do signups please read the GDPR and offer to the user the option to manage their consent for accepting to provide data when they created their account: for example (IANAL) the user should be able to delete their account, download their data, retract the consent and have their account with all the info provided destroyed. You can keep data for legal reason for the minimum required period.