It's not a loophole. Strict necessity is well defined, and per the opinion quoted in the fine article:
> While [cookie-based analytics] are often considered as a ‘strictly necessary’ tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user […]. As a consequence, these cookies do not fall under the [exemption].
Companies can still do it illegally of course, and many do, but there is no law that can stop people from doing illegal things.
> While [cookie-based analytics] are often considered as a ‘strictly necessary’ tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user […]. As a consequence, these cookies do not fall under the [exemption].
Companies can still do it illegally of course, and many do, but there is no law that can stop people from doing illegal things.