That is completely false unless you are talking about the pre-GDPR e-privacy directive.

GDPR only uses the word cookies once and it comes immediately after the phrase "such as", i.e. it's a non-exhaustive list of examples of ways that you could track someone.