It almost sounds like the law is too weak. Despite all the cookie notices I've seen, I never knew they were only asking permission to track me across sites. If that's what the law is for, then perhaps the warnings need to be even more obtrusive to deter sites from doing such tracking.