Even that law (which got updated along to align with GDPR IIRC) does't require the cookie banners that the industry has barfed up.