Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot b

Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot be singularly authoritative, in that your decision of "allow" /"disallow" cannot solely depend on the value of the cookie. So to try to construct a way one could do this, the are some constrains on the possibilities: * Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof. The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.