> Why not just let browsers controls who sets what cookies? Because it doesn't have anything to do with cookies. You don't need a banner if you use CSRF cookie

> Why not just let browsers controls who sets what cookies? Because it doesn't have anything to do with cookies. You don't need a banner if you use CSRF cookies, you don't need a banner if you use them for stuff like CloudFlare's anti-DDoS script, and you certainly don't need a banner if your site requires cookies for basic functionality like logging in. The browser can't possibly tell what the server is doing with its cookies. It might even be using a single cookie as CSRF protection and ad tracking at the same time.