needing consent and informing the user are two distinct concepts
I think you did need to explicitly tell the user about it.
But I think (not fully sure) they did relax that recently so just listing it in you Privacy Policy or similar should be enough by now.
But also due to how enforcement is designed it's not that you really had to worry about anything if you only have non-censent requiring cookies and list them clearly in the privacy policy. Worst case a privacy agency tell you to "improve on it" without penalty.
It's just which site (or app) today doesn't use something like Google Ad Network, or Metas Ad Network, or Apples Ad network. All of which do not support ads without tracking (which still are very viable, e.g. select ads based on what the side/ad is about).
https://commission.europa.eu/resources/europa-web-guide/desi...
> Cookies and similar technologies that generally do NOT need consent
> (…)
> Authentication cookies, for the duration of a session