[orev]

And how does one track if payment has been made without using a cookie?

[robocat]

From cameron90 above:

Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!).

Third party advertising tracking cookies are absolutely not (without consent).

[mobilemidget]

By the information a payment provider sends back.

Edit: guess somebody never integrated a payment provider :-)