The GDPR mandates that data subjects provide informed consent before you are able to collect and/or process their personal data for non-essential purposes (ads & analytics don't count).
The technical means you use doesn't matter. It can be cookies, but it can also be browser fingerprinting or IP addresses (which you can't deny as the remote server needs to know your IP to communicate with you), or it can even be information you manually enter (such as name & address for payment processing).
A purely technical solution will only cover the black & white case of "provide the data or not", it will not cover more nuanced cases where you need to provide the data for essential purposes (the IP so you can load the website, personal details for payment processing) but do not wish this same data to be used for other, non-essential purposes. A legal solution here is needed and that's what the GDPR is about.