The spirit of the law is protecting the privacy of site visitors from being leaked to third parties, intentionally or otherwise, and gaining their informed cons

The spirit of the law is protecting the privacy of site visitors from being leaked to third parties, intentionally or otherwise, and gaining their informed consent before doing things with cookies that violate that privacy. So the particular focus on third party cookies (be it 3rd party analytics tools and/or third party advert networks and/or 3rd party AB testing frameworks). These 3rd parties amass browsing habits and habits of visitors across multiple sites and topics. They use that information to build personalised profiles of an individual. This is done without the individual's consent. So the individual believes they've visited a set of independent websites, and they don't realise that some third party is watching over their shoulder. If they realise that is happening, and the implications of that, they would probably decline to participate, if they knew how. So consider the use of cookies with that as a guide (but I am not a lawyer, if you are not absolutely certain, consult a lawyer). I, for one, would be very surprised if a business got successfully sued for having a first-party cookie that clearly wasn't shared with any other site that was used to present a "Welcome back" message. Unless there was a third party script on the page watching for the appearance or non-appearance of that message.