If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it seems to me that there is a catch 22 here: they specifically refused the storage of their data, and now the website is supposed to store that somehow.
How can you store that information in a compliant way?
My initial thought is to use a cookie, but would that be non-compliant? They did just refuse the storage of cookies on their device... And if I store it in a database somewhere, how am I supposed to associate that refusal with that user if I can't store personal information?
According to the accepted answer to this question, you can use a userId or some such. But first of all that is in the context of consenting, not refusing, to cookies; secondly, if that identifier is associated with a user, then by definition it is personal data (right?) and therefore storing that information would be non-compliant.
Regarding the storage of consent, is it enough to store that in a cookie on the user's device or do you really need to store it in a database somewhere? That really seems superfluous to me.