Also, why would I make such an obvious mistake if what you are saying is correct? By your logic, I should've not put a cookie banner up to be transparent about the sign in cookie, because I am a criminal mastermind, nefarious and full of red flags.
You can use the developer console of any modern browser and see that 123Metrics only sets a login cookie needed for site functionality and nothing else. I explicitly say that in the privacy policy and the fact that no third parties are involved.
I am a member of the EU. GDPR directly applies to me. Why would I risk a startup by not being truthful about this?