The law is explicitly about 3rd party cookies, something that is harder to classify.
The intent of the law was to get website owners to stop leaking data to 3rd parties.
The result was everyone slapping a poorly understood warning label on everything.
Cookie banner frustration to be tackled by EU
As an aside I do find it funny how 'bosses' insist on the cookie notice to make their website official looking.
Absolutely! How else does it know to store the cookie on the user's machine.
So how would the browser differentiate those cookies from ones which are being used for data collection and tracking, which do require the warning message? It would require some sort of intent-signalling protocol between the website and the browser, which is probably more complicated than just requiring the site operator to include a bit of HTML.