Actually the law cares only about tracking not cookies.

And there are a lot of ways to track users even without cookies.