No cookie is strictly necessary, you can encode it all into request tokens in the URL, so this is a meaningless exception.

The law is not about cookies specifically, it's technology neutral. The law doesn't even include the word cookie anywhere.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

So you’re saying if I log into HN, every intra-site link should be rendered with “?token=<secret>” and if I send a link to a friend it will let them be logged in as me?

No, because that would be ludicrous, cookies are obviously necessary for the concept of a “login” or even just a “session” to exist.

The ePrivacy directive basically defines it as 'any data your site gives to the user's terminal that the terminal then passes back to your site'. Request tokens in the URL would qualify, but notably storing something in localStorage with javascript that is never sent back would not.

let me guess: you're some sort of programmer?!

For a programmer of some sort this may seem a meaningless exception, for a lawyer it is not.

I am not a lawyer, but I have had a few law classes and worked a bunch in the legal services branch. If I am asked legally speaking - is this cookie strictly necessary? I will ask is the cookie used only for the purposes of the service provided to the user and which the user expects to get.

If the cookie is used so that when the user logs in and goes to page two of the article they are reading they can read that article without having to log in again we can say it is needed for the service. If the cookie is used to provide recommendations for other articles by using their user history to compare with other user histories and what other users like to read it is not needed for the service. Although from the point of view of the company it sure might be nice to have.

If the cookie is used for your state management of the items you have placed in your basket so that you can go to buy those items it is needed, if the cookie is used to look up your past history and give you recommendations for other stuff to put in your basket, things you bought in the past why not buy some more of those, or how often you rated products you bought badly or anything not required for the current transaction you are doing to go smoothly it is not needed.

As a general rule lawyers and the courts are good at sorting this stuff out, but as edge cases get complicated so does code, and nobody wants to handle all that stuff themselves, so instead they pay for a company that develops cookie banners and everybody gets asked if they accept cookies or not.