I believe it's the ePrivacy regulation rather than the GDPR that applies here. It's my understanding that you no longer need permission for certain usages of co

I believe it's the ePrivacy regulation rather than the GDPR that applies here. It's my understanding that you no longer need permission for certain usages of cookies where they're needed for certain functionality, such as shopping carts - and possibly some degree of tracking -- perhaps -- if some or all of the following are done: * The data isn't retained for too long * IP addresses are anonymised * Session cookies or cookies with a near future expiration date are used * First party cookies are used What exactly you need to do is not always totally clear, but usually the balancing test works like "is it required for legitimate business purposes that the user is likely to expect". If they don't need permission at all, then they're free to ask away. (Although it does show that people have failed to understand these changes in the law.)