This seems to be pretty hazy. The ICO report says we would advise anyone whose website allows or uses third party cookies to make sure that they are doing
everything they can to get the right information to users and that they are allowing users to make informed choices about what is stored on their device.
You can send cookies with any HTTP reply, so how do you know if that image you are hot-linking from a 3rd party site doesn't send back a cookie?
There seem to be so many technical vagaries that make this so tricky to implement properly.