That's not the law, that's the implementation that's the issue. The same EU body quoted above has passed the message for a long time that that's not needed eg for purely technical cookies.