> Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is eq

> Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. It does, or rather the law doesn't state cookies at all. It has nothing to do with cookies. All the law says is you require informed consent if you want to harvest personal data and use it for tracking. Cookies are a common way to do that. But cookies used for session and whatnot are exempt, because they're not used for tracking. The problem is companies are maliciously compliant.