[oliwarner]

Storing data in a cookie is not the dangerous bit, it's the intent, the what you're storing that data for which matters.

A browser popping up a prompt saying "google.com wants to store a cookie, is that okay?" isn't enough.

The design of these cookie and enhanced data protection laws is that websites need to spell out their intent. To tell people what data they're storing any why. Yes, you could code that into headers and have the browser relay that information, but that's the stalemate we're in.