[Nursie]

"the business guys in the company will continue to argue that yes, this is technically necessary for the functioning of their company/website/business etc."

Except it's not.

"Ask the engineers whether these things are "technically necessary" to facilitate the business plan, because the business plan is the entire reason the company exists. The answer is yes."

The Business plan is irrelevant. You're clutching at (false) straws here and you know very well what I mean by technically necessary for the functioning of the site, the law and/or guidelines even talk about implied consent covering only what is needed to allow the interaction between a site (the site you are ON, not a third party) and the user). In any other circumstances you have to ask. I don't understand what you find so hard about this - are you setting the cookie to enable the user to have a session on your site? Cool. Are you using it to track their movement? Not cool. End.

"Are we going to start legislating every detail of business?"

Where it starts to impinge on personal privacy, I hope so, yes.