If we're going down the route of regulation, and browser control, would it be a step too far to require standardised metadata in a cookie?

That way, each cookie could describe itself as login, tracking, optional functionality etc.

You can then penalise on cookies that purposefully violate this, and allow the user to centrally opt in or out of each type.