People all over this thread are just making up wildly speculative guesses about what the law says.

Here's what it actually says: https://gdpr-info.eu/art-6-gdpr/

Note that cookies aren't even mentioned. (You're in the right)