Functional cookies are fine. Even analytics is fine if you're using your own (though said own analytics must also company with GDPR personal data retention rules).

What is not fine is giving away your users' personal data to pay for your analytics bill.