How do you know it doesn't need a consent notice? Anything that tracks people uniquely, via a personal identifier, is in-scope and counts as personal data. Is the assumption here that it counts as 'legitimate interest'?
Ahh, cool! Someone else linked to your privacy policy where it's super clear "Visitors are not tracked by using e.g. persistent cookies".
Might be worth clarifying by bringing this line up especially as there are tons of "gdpr compliant" products that get fuzzy on the details pretty quickly.
