Session cookies are allowed (without consent) if your site has something like login or stored settings. You don’t need consent if the cookie is required to prov

Session cookies are allowed (without consent) if your site has something like login or stored settings. You don’t need consent if the cookie is required to provide a function to the user. Only cookies that are used to track user behavior, and can be tracked back to that particular user are disallowed. So things like Facebook like buttons would require consent (since Facebook will use the info gained to target you with ads in another context) while basic Google Analytics or similar is fine as it only presents aggregated data to the site owner and does not leak data cross-site. Some GA features do require consent though (like demographics tracking) as it requires Google to cross-reference between sites. You can generally turn these off (I think they even are off by default?) Note that implementation of the law also differs between EU countries. So a few are more strict. It is up to the national privacy agency to set exact rules.