There is the ePrivacy directive as well, which mentions cookies (as a representative example), and I think it requires user consent in cases where GDPR doesn't.

ePrivacy is now mostly about the requirement to notify the user that cookies are set, and what they are used for. But you are correct: https://gdpr.eu/cookies/