First, you do not need consent for anything deemed essential to your site. Furthermore, you kind of get to say what is essential and what isn’t, as long as you can reasonably defend it.

For example a shopping cart is certainly essential. Previous purchases, page views, etc all essential.

“Page views per session”, most likely not essential (though you can make the argument they are), but if you’re not installing an identifier on the user to track them (for example, they’re signed in and you’re aggregating as such), then you don’t need to ask for consent.

If this sounds like there are loopholes that’s because there are loopholes. Concretely, tracking consent dialog are one of the looser parts of gdpr.

So what I usually tell clients is: You do not need a consent dialog, unless you use a first or third party analytics library.

If you add a third party analytics library (google analytics, Facebook pixel, piwik, plausible, …), [edit: or third party ads, they come with their own tracking], do not load it until you’ve asked for consent.

Ask for consent once per account or per logged out device.

Give the option to accounts to revoke consent.

While it has been nicknamed the "Cookie Law", the ePrivacy Directive is about trackers that contains PII (Personally Identifiable Information) and the reason some cookie exist.

On a high-level, the spirit of the law is:

- if the cookie is essential to the site, consent is not needed

- if the cookie doesn't contain PII / isn't used for tracking, it is not impacted by the law, and thus consent is not needed

Now several examples you detailed could be done server-side, without any tracking cookie, or with a cookie if the user is logged (which implies accepting the website conditions and could be deemed essential). In those cases, no consent is needed. If on the other hand you use a tracking cookie, like a Google Analytics tracking cookie, yes consent is needed.

But generally speaking, you do not need a tracking consent banner unless you use tracking, directly or via 3rd parties.

If return counts are nothing more than "this user has visited the site before" and there is some benefit to the user (say, remembering their address or username) then I don't see why you'd need consent. This is in the legitimate interest of you and your user. This "legitimate interest" exception doesn't go as far as many of the nasty tracking companies pretend it does, though.

A history of purchases for an account is an obvious feature, but you need consent before you can use that data to generate a marketing strategy for example. So a cart history is perfectly fine, but training your recommendation algorithm in that needs consent.

You can use whatever you like to achieve the technical requirements for your site to operate from the user's perspective. Theoretically you could even use advanced device fingerprinting techniques without consent as long as the purpose isn't to gather data, but to serve an end goal.

As soon as you start aggregating data for your own benefit, you need explicit, optional consent from the user to use their data to your benefit.

Anonimised data can be used without consent, but good anonimisation is very very difficult to achieve. Data is considered PII if the data can be linked back to the individual user if you have a theoretical second database. Pseudonymisation, which is what most frameworks actually seem to do instead of anonimisation, is not enough to not need consent, because the data can easily be linked back to actual user data using a backup of your site database afterwards.

Tl;dr: as long as you use cookies and other features only to directly benefit the user, you need no consent. If the data you collect cannot possibly be connected to a user, you don't need consent. Based on my reading of the GDPR (not a lawyer but it was covered in an IT law class), that means 1: yes, 2: yes, 3: no, 4: possibly, 5: probably, 6: you've got the right idea.

You can find more details here: https://gdpr.eu/cookies/ You can also try reading the GDPR text itself, it's quite readable as far as legal documents go in my opinion.

The banners are there for you to opt-in to your activity on the website and beyond to be tracked by a 3rd party, possibly across multiple other websites.

We do not need to discuss whether a cookie is essential, because it's a red herring. It's not about cookies, it's about behavioural tracking, it's about your browser activity being sent to 3rd parties, being collated and used to e.g. serve you advertisements to sell you shit.

PS: You might be misinterpreting that what the court said about "personal data" (aka Question 2). The crucial bit here is this

>That interpretation is borne out by recital 24 of Directive 2002/58, according to which any information stored in the terminal equipment of users of electronic communications networks are part of the private sphere of the users requiring protection under the European Convention for the Protection of Human Rights and Fundamental Freedoms. That protection applies to any information stored in such terminal equipment, regardless of whether or not it is personal data, and is intended, in particular, as is clear from that recital, to protect users from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.

This just means that cookies containing personal data and cookies containing no personal data have to be handled the same. This still means essential cookies are still fine. It just means there is no difference between putting some static text, random string (which could be an identifier), or the users home address (personal data) in a cookie. Planet49 tried to claim that their tracking ids were not personal data and therefore they do not need any consent, and they failed, that's all.