It's possible that they're functional cookies in the sense of article 5(3) of the ePrivacy directive (so no consent necessary) but still personal data under the GDPR that's processed on the basis of legitimate interest. In that case they would still need to inform users of the processing under article 13 of the GDPR. Though that can usually be done with a less intrusive link to the privacy statement in the footer.
The resulting outcry from the Reddit community ultimately led to a planned protest, from June 12 to 14 in which moderators for the site would make their communities private or would restrict posting.