Opting-in should be a client feature, not a website feature... make browsers block cookies by default, and then add a button next to the title bar to accept cookies for this webpage (for them to remember the login).
GDPR is not just about cookies. In fact cookies are already next-to-useless for tracking because modern browsers have countermeasures against it (which unfortunately does hinder legitimate usage like cross-domain SSO).
The GDPR is about data processing consent as a whole, regardless of how the data was collected. It includes data that you can’t withhold such as your IP address, browser fingerprint, etc.
