Instead of ranting and providing nothing but conjecture about how "expensive" GDPR is (whatever that means), or insinuating that lawyers "arguing" about something proves that legislation is ineffective (that's literally their job), refer to first hand sources and ask constructive questions in good faith about what you don't understand. Here's one example: https://gdpr.eu/cookies/

Both first party session cookies and "shopping cart" cookies are mentioned as explicit examples of cookies that do not require prior consent and are unlikely to cause any concern.

The GDPR doesn't even mention cookies.

It's the ePrivacy Directive that regulates them (or, more precisely, "information stored in the terminal equipment of a subscriber").

And the ePrivacy Directive does, in fact, define what's allowed without notifying the user:

"any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."