Well the law applies to all EU citizens, at home or abroad, in one of the weirdest jurisdiction overreaches I’ve ever seen.

So the company could have one or more EU citizen customers who even live in the US.

But I clearly like the one cookie for sessions approach better, and most of these alerts don’t actually fulfill the requirements anyway.