EU probably won't give a big shit about a tracking cookie, because you can delete that. But if Data Controllers won't perform proper delete/anonymization, then shit will find and maximize the action potential, even if there's a rotating blade in the way.