Where are cookies mentioned in the GDPR?

Where are cookies mentioned in the GDPR?

The GDPR mentions cookies once, in Recital 30:

Natural persons may be associated with online identifiers…such as internet protocol addresses, cookie identifiers or other identifiers…. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

What this essentially means is that cookies, where they are used to identify the device or, in combination with other data, the individual associated with or using the device, should be treated as personal data.