Setting cookies if fine according to the GDPR. It's tracking cookies which are of relevance.
https://ec.europa.eu/info/privacy-policy/europa-analytics_en
Before accepting any cookies I got a _pk_id cookie expiring in 13 months.
They are clear this is what will happen.
Just check it for yourself before you listen to the lies / blather you read here.
The EU's own websites track you on first landing.
Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it.
The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.
That seems fine. Not the greatest UX but as long as you're able to decline it should be compliant.
"Consent must be freely given, specific, informed and unambiguous."
So a question remains, if you give someone the option to decline to be tracked, is that enough? Or do you need actual consent?
The EU website is doing the tracking with option not to be. Other experts say you really should have consent first before doing any tracking.
Anyways, not giving my opinion on which is right, just that there are different views, and even EU does it in ways I think that folks here do not understand.
The one thing, the EU sites are extremely CLEAR about things, I do like that.
I don't think the UK GDPR differs yet from the EU one, so the ICO guide might still be useful. I find it much clearer than guidance I can find from the EU: https://ico.org.uk/for-organisations/guide-to-data-protectio...
I'm sure GDPR allows for the setting of cookies, just not the storage of personal data without explicit consent.