You described 95% of EU's work.
This gave companies permission to do things which would ordinarily be illegal under the ePrivacy directive, but did not make it mandatory for them to do so. That permission is now revoked (or will be when the derogation they were trying to extend expires in two weeks).