If a session is required to service a user's explicit request (eg. "add item to basket" but not "track user for ads") then explicit consent isn't required. The user's explicit request is enough. So there's no conflict.
Stuff required for the actual functioning of the site is explicitly exempted in the GDPR. Generally speaking, do not take your information from whoever is selling you something... or is selling you.
