Don't confuse cookie laws with data laws