I understand why some people might be afraid of the risk. My point is that since you already implemented the code to detect EU customers, you could as well deci

I understand why some people might be afraid of the risk. My point is that since you already implemented the code to detect EU customers, you could as well decide to not to set cookies rather than block them. In terms of complexity it's basically the same, but you get the benefit of increased exposure.