You're correct if you're _only_ using cookies. My point was that it could be combined with the other tracking means (say a browser fingerprint or HSTS fingerpr

You're correct if you're _only_ using cookies. My point was that it could be combined with the other tracking means (say a browser fingerprint or HSTS fingerprint or both) and that value be transferred in a "first party" domain that was really just a CNAME'd third party server -> and you have a solution that would meet the requirement to "only set 1st party cookies" but would miss the intent of the regulation.