Because it's not under GDPR, but under ePrivacy.

See section 3.6:

https://ec.europa.eu/justice/article-29/documentation/opinio...