You cannot store a users personal data like IP
or cookie id unless you have consent from the user.
I expect that nobody will comply with this.Smaller companies seem to think GDPR is something they can fix by changing the legalese in their impressum and privacy policy. "Yet another trip to the impressum generator".
Bigger companies seem to pretend they misunderstand the GDPR. I got emails and popups from Facebook, Twitter, Instagram etc informing me about all kinds of nonsense about how they changed their policies and asking me all kinds of unrelated questions about what kind of ads I want to see.
Not a single company asked me for permission to store my personal data.
If you're talking about tracking cookies from an ad company, you better mention them in the privacy policy.