GDPR is regarding personal data, which includes cookies as well as any other fingerprinting. Even though browser fingerprinting does not persist any data on a device itself, explicit consent must be gathered before it’s used for processing (i.e. tracking) purposes.