[troupo]

GDPR is a General Data Protection Regulation. It applies to everything.

10 years. It's been in force for 10 years. The tracking/ad industry has really managed to brainwash everyone into thinking it's about cookies (even though GDPR doesn't even mention cookies except as an example of tracking)

[CodesInChaos]

There is the ePrivacy directive as well, which mentions cookies (as a representative example), and I think it requires user consent in cases where GDPR doesn't.

[troupo]

ePrivacy is now mostly about the requirement to notify the user that cookies are set, and what they are used for. But you are correct: https://gdpr.eu/cookies/