The shitty thing is, she'd probably be better served by denying cookie preferences... but despite whatever regulations say, companies find impressively difficult ways to keep the user from answering "no, please don't spy on me".