I could imagine cookies being implemented by the browser in the same way that webcam permission is requested. Something along the lines of "this website is requesting to store cookie "domain;X with purposes Y". This would make setting millions of cookies a UX sin, and cookies would only be set on predictable user interactions such as logging in. Unfortunately the definitions of "purpose" will still need to be defined by regulation to be enforceable. Once you can identify a user, there's no technical limitation that can prevent tracking.