The law contains some ridiculous language about storing data on the user's device, which applies to cookies in particular even though that category in general makes no coherent sense, because the thing that should matter is if you can identify the user/device, not whether you used something in the shape of a cookie to do it.