The spirit of these regulations was undoubtedly to inhibit the practice of cross-site tracking using third party cookies or cookie-like technology. However, nei

The spirit of these regulations was undoubtedly to inhibit the practice of cross-site tracking using third party cookies or cookie-like technology. However, neither the EU directive nor the laws that implement it make a distinction between first and third-party cookies. They only distinguish between those that are "strictly necessary" (which I take to mean cookies that if you block them would prevent the site from functioning at all) and those that are not. Tracking within your own website for analytical purposes doesn't fall under the functional interpretation of "strictly necessary"; your site continues to function just fine if the Google Analytics beacon isn't fired, or can't distinguish between a first-time visitor and a repeat visitor or follow a particular user through the site. I have heard people argue that analytics are operationally strictly necessary; that we need some insight into the behaviour of site visitors in order to operate an online business effectively. There may be something in that interpretation, but I'm a lowly web architect, not a lawyer. As such, I would be wary of accepting this more lenient interpretation without significant input from someone more schooled in the laws of our land (or any land, for that matter) than I.