The GDPR doesn't explicitly require cookie consent. However, it considers certain types of cookies to be forms of personal data, so you need a legal basis to use these types of cookies. Consent is one of the acceptable legal bases.