It's from the EU Cookie Directive, updated in 2015: https://www.cookielaw.org/the-cookie-law/

and it's going to get more complicated under GDPR and the ePrivacy directive:

https://www.informationweek.com/big-data/cookie-law-vs-gdpr-...?

GDPR is NOT limited to the EU, but is focused on protecting EU data subjects no matter where they are, so US companies may be affected. Many US companies are signing up for Privacy Shield, which is updated annually, so it will spread beyond the EU in the years to come.