The text from Article 3 of the regulation is:
- This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
Article 3 is about the scope of the regulation. This particular question is clarified by Recital 24 (emphasis added).
1 The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. 2 In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
The point of all this is that if you are collecting data about someone who is currently in the EU then the GDPR applies to you, regardless of where you are. The "currently in the EU" bit is significant: the GDPR doesn't apply if you collect data about the activities of an EU citizen who happens to be currently in the US, but it does apply to a US citizen who is visiting the EU. The term "behaviour" is used to distinguish data about what someone is currently doing from static data such as date and place of birth (which is presumably much more tied to nationality than current location).
Based on this recital, it seems unlikely that some functional cookies constitute "monitoring". If the cookies are only used for short-term functionality then you can make sure of this by giving the cookies a short expiry date or making them session cookies.