Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.

So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.

The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.