They are, but the failure of a law is that people did not know that, and just put cookie warnings to be safe, and in the end all websites had cookie warnings making the entire thing pointless.