Wanting to use unnecessary cookies is their choice, not something a law forced on them.

Non-malicious compliance with privacy laws would mean respecting people's privacy.

The law is not about cookies specifically, it's technology neutral. The law doesn't even include the word cookie anywhere.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

So you’re saying if I log into HN, every intra-site link should be rendered with “?token=<secret>” and if I send a link to a friend it will let them be logged in as me?

No, because that would be ludicrous, cookies are obviously necessary for the concept of a “login” or even just a “session” to exist.

The ePrivacy directive basically defines it as 'any data your site gives to the user's terminal that the terminal then passes back to your site'. Request tokens in the URL would qualify, but notably storing something in localStorage with javascript that is never sent back would not.

let me guess: you're some sort of programmer?!

For a programmer of some sort this may seem a meaningless exception, for a lawyer it is not.

I am not a lawyer, but I have had a few law classes and worked a bunch in the legal services branch. If I am asked legally speaking - is this cookie strictly necessary? I will ask is the cookie used only for the purposes of the service provided to the user and which the user expects to get.

If the cookie is used so that when the user logs in and goes to page two of the article they are reading they can read that article without having to log in again we can say it is needed for the service. If the cookie is used to provide recommendations for other articles by using their user history to compare with other user histories and what other users like to read it is not needed for the service. Although from the point of view of the company it sure might be nice to have.

If the cookie is used for your state management of the items you have placed in your basket so that you can go to buy those items it is needed, if the cookie is used to look up your past history and give you recommendations for other stuff to put in your basket, things you bought in the past why not buy some more of those, or how often you rated products you bought badly or anything not required for the current transaction you are doing to go smoothly it is not needed.

As a general rule lawyers and the courts are good at sorting this stuff out, but as edge cases get complicated so does code, and nobody wants to handle all that stuff themselves, so instead they pay for a company that develops cookie banners and everybody gets asked if they accept cookies or not.

If you're in a shopping site and "add to basket" -- explicity requested.

If each page you browse on the shopping site shows what's currently in your basket -- explicitly requested.

If you checkout and get a list of what's in the basket and give you card details for payment and email for receipt -- explicitly requested.

No consent needed.

On the other hand, deliberately analysing log data after the fact for which products they looked at but didn't add to cart -- consent needed.

Javascript measuring which sub-parts of the page they lingered on -- consent needed.

Tracking how often they come back without buying anything -- consent needed.

Using the email address for anything other than order receipt and delivery status -- CONSENT VERY MUCH FUCKING NEEDED.

See the difference?

I don't understand why this was downvoted. It's informative and factual.