But for some reason they did send two cookies to me when I just visited the site without doing anything.
And "because other sites do it" is not enough reason to use cookies.
I could imagine cookies being implemented by the browser in the same way that webcam permission is requested. Something along the lines of "this website is requesting to store cookie "domain;X with purposes Y". This would make setting millions of cookies a UX sin, and cookies would only be set on predictable user interactions such as logging in. Unfortunately the definitions of "purpose" will still need to be defined by regulation to be enforceable. Once you can identify a user, there's no technical limitation that can prevent tracking.
The whole cookies acceptance pop up was also in the original cookies spec somewhere down the line browsers stopped asking mostly due to the fact that sites got dependent on cookies more and more especially in the early days where there was little to no session management on the server side so you had to either use cookies to store all the state information or encode it into the URL and have your CGI script parse through it.
So, what if those dialogs would come back? Maybe with a more user friendly UI to accept site's ad tracking cookies or not, and remember the choice for the future? Would user care about them? would browser vendors care about them? would sites acknowledge the choice made?
__cfduid seems very random. It changes every time I reload the page.
tdukey stays the same. Even when I remove it or use a different browser it comes back to the same value. When I connect through Tor it gets a different value. When I click "new circuit" in Tor it changes to a different value. So it looks like this cookie is a hash of the IP address you connect from.
https://support.cloudflare.com/hc/en-us/articles/200170156-U...
TDUkey is likely the one that holds the persistent IP value hash for the randomized one to work correctly.