Browser fingerprinting and countless other techniques can and are being used as well.
The outrage over cookies is quaint, and only demonstrates that people who freak out over them don't understand modern tracking technology at all.
- the so-called “cookie law” is not limited to cookies (see ePrivacy article 5(3) for more information, it's actually any technique allowing to store or retrieve information from a user's terminal);
- ePrivacy exists since 2002 (so, decades);
- any kind of tracking allowing to identify unique users will require consent, cookies or not.
Those work, but Google has publicly committed not to use them for ad targeting. Hence all their work on privacy sandbox (attempting to preserve as much of the economic effects of cross-site tracking while fixing the privacy leak).
1 - Why would I trust anything Google says?
2 - What else could they use that information for apart from ad targeting that they're not telling us about?
2: Detecting fraud and abuse, which is generally interpreted as not requiring consent under the GDPR (though I think that may not be correct: https://www.jefftk.com/p/can-ads-be-gdpr-compliant).
If they did it would be far from the first or even the millionth time a company has said one thing and done another... even when it's ostensibly illegal, immoral, or merely bad PR. Most of them get away with it too, or get just a slap on the wrist if they're ever caught.
The people responsible usually suffer no personal consequences, and just go on to get cushy jobs in other companies if they're ever fired, or have enough "fuck you money" to not even ever worrying about having a job for the rest of their life. That's assuming there are actual professional consequences, where there often aren't.. some even get away with getting huge bonuses while they drag their companies through the gutter and in to the ground.
Any form of user tracking without opt in is not permitted.