It's only 'mandatory' (see comment below) if they (whether the primary operator or the subcontractor) is doing things that aren't strictly for functionality. T

It's only 'mandatory' (see comment below) if they (whether the primary operator or the subcontractor) is doing things that aren't strictly for functionality. The problem is that while the EU hopes that disclosures are designed to introduce friction to make the site more privacy-friendly... let's say that money is still a strong motivator for a lot of websites. I even spotted cookie prompts that were essentially that "close door" button on lifts.