Cookies are tools that process Personal Data and under GDPR Processing requires a Lawful Base.
Accepting the Cookies Policy will still mean that the user may opt-out from some Cookies being used to process his/ her Personal Data... so "accept Cookies Policy and that's it" is not a valid approach.
Personal Data Processing derives from "Purpose" and "Scope" under a Lawful Base and Services are finite, so you MUST erase the information gathered by Cookies once the Service ceases if there is no Legal Obligation to maintain it (ususally there is not, in opposition to let's say invoices that must be kept for 7 years but do not derive from Cookies Processing).
10 years for Cookies really seems way too much... it is not arbitrary, it MUST derive from the "need to process", having the DAta Subject aware of it and always enabling him/ her to opt-out.
Your Cookies Policy needs to detail WHAT each Cookie does and their relevancy towards the Services being rendered.
Some Cookies may act as Service enablers, therefore you need to explain that if the user opts-out from those, he/ she may not get the service that was contracted or expected.
Other Cookies are relevant for you as a company (e.g. Google Analytics), so the user (Data Subject) may really opt-out at any time, for there is no impact in the Service towards him/ her.
Then you may have Cookies that profile the user... well, regarding those you better comeup with a good explanation on why the user will hugely benefit from them... people is getting scared by the day, and opting out from anything that "smells" like "profiling".
If you are a developer, you should really get support from someone who knows about GDPR and not try to do your best, for ... well... do not take this wrong but odds are you will not do an assertive job.
Retention Period under GDPR... (39) ensuring that the period for which the personal data are stored is limited to a strict minimum. + (45) disclose (...) the storage period + (61) + (65) Data Subject has the ‘right to be forgotten’ where the retention of such data infringes this Regulation + Article 5 (e) + Article 6 (3) (b) + several more...