For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent ! Because it's not necessary for the service... (even if it might be in your interest)
EDIT: if your statistics are not bound to personal informations (so you dont need statistics for INDIVIDUAL users but only the your users AS A WHOLE) then... no problem for RGPD and no need for consent. Actually, that's what a lot of RGPD-compatible statistics do (like Matomo and others...)