Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.

The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)

Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).