I meant GDPR. It's the reason why websites have to get consent if they want to track you. I believe you're right that it doesn't mention cookies though, I don't believe it cares about what technology is used for tracking.

> Edit: by the way no modern website uses cookies to maintain your shopping cart, and instead of relying on a persistent credential cookie

That's what I meant. You store some unique ID on the client in a cookie, then you have a shopping cart database on the back-end. I didn't mean to imply that the cart items are stored in the cookie, just to distinguish the persistent shopping cart use-case from the logging in to a user account use-case.

> you could just use a password manager to expedite login and be more secure overall.

I do this. I still want to be logged in for a while.

> Finally, “private” mode on most browsers contains cookies to short lived session cookies within the tab lifespan.

I know. Would you find it very convenient if your browser always acted as if you were in private mode and didn't keep you logged in for longer than the lifespan of the tab? No? Neither would I.