The only time I've got into issues was with an american firm using an american law (dmca) to attack me (a non-american) and my hosting company (a non-american hosting company)
[edited with less anger]
Here we go again.
The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should.
The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.
Can you share your website/service?
But if you want an example of a fully featured public site which doesn't need cookies
Load that in lynx, which asks for every cookie, and none are set.
Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you.
Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.
I am not convinced this is true. See: https://law.stackexchange.com/a/32157
Also note that HN is likely in violation of this since there is no "Remember Me" checkbox when logging in. There is no indication that logins will be persistent.