Isn't this open to some interpretation? Seems like a pretty wide loop hole. Seems that this will allow a site to set/read it's own cookies no problem. Third-party ad-networks and trackers though, yeah, they would not fall within this definition I think. And isn't that a good thing?
One might also say that cookies are never strictly necessary. We can always just put tracking IDs in the URL. And when browsers get rid of URL bars, it'll be harder for people to copy/paste the URL (with session ID) so the 'security' aspect against that argument will fall on deaf ears ("I can't see the problem you're talking about, so it's not real").
And if people don't want to be tracked, and the site loses out by not tracking them, so be it... That is a better situation than somebody being tracked without their knowledge/consent.