Indeed, this caching technique would be covered by "the cookie law". However cookies can be audited, but many images contain legitimate ETags. It's more difficult to detect when websites use this to track users, and I don't think any government agency is capable enough to check whether companies comply to the law.