I'll quibble with the 100% thing. Yes, you can shove session ids into the URL but it's generally pretty terrible from a security and UX perspective, you can't

I'll quibble with the 100% thing. Yes, you can shove session ids into the URL but it's generally pretty terrible from a security and UX perspective, you can't share links, and caching becomes much more difficult. In that light I tend to agree with GP. If you're just using cookies to run sessions for your site, I just can't see regulators coming down on you. There's some potent mix legal and technical pedantry combining with the profit motive of consultants everywhere that has led to a huge wave of overblown FUD around GDPR. The fact is, ad-tech has been running amok for years and I don't think it's that hard to draw a line if we're intellectually honest. Of course it will take years for case law to catch up, but it's not as hand-wringingly difficult as some would have us believe.