It’s not the legal risk, it’s the desire to track users. How often have you seen a cookie banner that says “we only set cookies when it’s essential to the site’s functionality so there’s nothing for you to opt out of”?