Websites need cookies.
I don't get why I have to suffer through this for a few puritans who literally lose nothing in the process of this transaction but act as if Stasi is watching them.
Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
You don't need cookies for basic aggregated analytics. Now if you want to track and record mouse movement, you do, and that's a privacy concern.
The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.
Actually you can't send any cookie that is not essential to the operation of the website without consent and that would include analytics regardless of PII. same for pixel tracking / fingerprinting, it's all a no-no.
There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask.
Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.
The practical argument I can understand. From the abstract argument though, it sounds like you'd be opposed even if the anonymization could be guaranteed, which I don't understand. Why is it "spying" to try to understand in aggregate how users are using your website? How are you supposed to eg. identify usability problems without this information? And what is the harm to users? (Again, in the abstract case where we leave aside any possibility of individual users being identified.)