And the law also only requires you to ask the user if they want to be spied on.
It's not tightly bound to cookies in any way.
And vastly misunderstood.
There was a predecessor which was somehow tied to cookies but even then you didn't need to ask for setting purely functional cookies.
But somehow everyone ended up interpreting it as such.
Maybe because most sites don't have many purely functional cookies or fingerprinting, as they always track you for other purposes, too.