This is an interesting one:
https://www.itgovernance.eu/blog/en/how-the-gdpr-affects-cookie-policies
as this implies you need to ask for consent BEFORE any cookies are set, and then ability to opt out of cookie collection! How does one achieve that?
Dan