Does GDPR require consent for cookies?

Not for every cookie, and GDPR is not the legal instrument that creates the EU’s general device-storage rule.

The ePrivacy Directive determines when storing or accessing information on a device requires consent and provides relevant exemptions. Where that consent standard refers to EU data-protection law, GDPR supplies the requirements for valid consent.

In other words, ePrivacy answers much of the “when is cookie consent needed?” question, while GDPR consent determines what valid consent must look like where it is required.