The current best-practise guidance[1] suggests that you split your cookies up into 4 types: essential, performance, functionality and tracking. All types should be selectable, but the first three could be opt-out by default as long as you display a notice. Only tracking cookies need be opt-in, and I’m fine with that.

BT have a nice implementation of this, or at least would have if they’d turned off tracking cookies by default (hah). I assume that their code flexible enough that they can do this on the deadline. Look at the bottom right of http://www.bt.com/ (or any page on the same domain).

[1] http://www.international-chamber.co.uk/components/com_wordpr...

You remember the ones who say yes. As for the ones who say no, you ask them every time until they say yes. So I guess the system works.

After you log them on, you can set a cookie for session management (it's allowed) and use that to remember a preference stored in your db (which you can get by default on registration).

If you can't log them on, well... I guess you should try to guess their country, and if it's UK, you don't track.

This is another case of well-intentioned but probably unenforceable legislation by our detached European elites.

I think the assumption is that you don't do any tracking by default and then the first cookie you set is to allow you to set other cookies in the future.

The ICO would have website owners pop up a box to new users asking them to give consent to using cookies.