The EU is not stupid. They categorized cookies into the necessary ones for site-usage and those that aren’t. So developers just categorize their session cookie (rightfully) as necessary and that’s it.