Yes, they are correct in that there is no law requiring a banner popup. Functional cookies are always allowed, and you could always default to just not track people so you don't need their consent either.
But if you want the user to give consent for the tracking cookies, and basically any site with advertisements really wants you to, then the popup is required,
because the alternative - a disclaiming saying "by continuing to use you give consent bla bla bla" - has been deemed illegal. You need to get the user to actively opt-in to them and press I accept, and that means you nag at them with a popup. DNT header was a fantastic idea, for the users. Of course they didn't want to use it, as it would have to also be opt-in (and so default to do not track) and probably 99.9% of browser users never change the default settings.
So while there is no law that says "you need a cookie consent popup", there also effectively is.
But as most of the companies providing and running ads are very much on the tracking users business, e.g Google/Meta/Amazon/Microsoft etc, I'd imagine they won't be very willing to provide your site with tracking free ads, and the smaller companies that would, probably can't provide anywhere as nice of a payout.
So you are left with the people who would be willing to reduce their profits for the benefit of their users, and looking at what a shitshow todays internet is, there's maybe a dozen of those left.
You can absolutely track people on your own website, if you store that data locally and anonymized. Matomo is always an option instead of Google Analytics.
Lawyer of my former employer says no, you don't. If you don't combine that tracking data with personal information and don't track them on other websites and store locally without giving any information to third parties.