Original cookie law from years ago restricted also that. In old cookie law you were not allowed to store cookies without consent if cookie was not required for functionality (e.g. shopping cart, login). User experience cookies required consent. So I could not show related products based on activity (e.g. visited categories, purchase history, number of visited pages, ...) if user didn't agree.
- Does GDPR replace cookie notice law?
- Do I still need to use a cookie notice?