Storing login tokens and cart information falls under "legitimate interest", which does not need consent. They just aren't allowed to use that information to do anything else with it.

I've rejected all optional cookies/tracking for many years and I've never noticed any missing functionality.