You are likely violating the GDPR. You can’t just assume consent (that applies to other areas of life), that’s the whole point.
Either you only use cookies which are essential for basic usage—in which case you don’t even need to tell users about it—or you need to provide a way to refuse everything else which has to be at least as easy as the way to accept.