Dr. Kris Shrishak:

Much of the cookie consent requirement initially comes from the ePrivacy directive and the personal data aspect comes from the GDPR. So far, even when it comes to AI systems, that is also the angle where this comes in. There are a couple of things. The first is the legal basis the companies use to collect that information. If they use consent, it is an opt-in mechanism. Some companies are pushing for the use of legitimate interest, so then there is no opt in or opt out unless the company gives the option to opt out. The ideal scenario would be consent based only.