They might be considered "strictly necessary" or they might not identify you but just store non PII.
I doubt that though, and Twitter's one has an expiracy of two years which is illegal according to https://gdpr.eu/cookies/
This makes me what to read the ePrivacy Directive, I read most of the GDPR and it's not that hard to understand (I don't believe I understood all of its implications though).
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!