IANAL, but this is not entirely correct. For example, if you have server logs, that's processing personal information, most likely under GDPR Art. 6 lit 1f (legitimate interest). Under Art 13 the user must be informed of this. Because of the information requirement the Do-Not-Track is not enough unless you really, truly do not track any PII (which includes the IP address).

Equally, this is incorrect:

> You may not collect personal information without consent.

There are a whole host of reasons listed in Art. 6 when you do not need consent.