If the browser was to just disable the cookies API until the user allowed the site to store data in cookies, it wouldn't be something that the site would be able to ignore.