Shopping carts (and other purely-functional, essential purposes) do not require a consent popup.

Shopping carts require cookies if they go beyond what is "strictly necessary to provide a service explicitly requested by the user". This is quite a high bar, and most shopping cart implementations do not meet it. For example, if you put something in your cart on Monday but then don't purchase, it is not strictly necessary that it still be in your cart should you return on Tuesday to complete your purchase, so holding it overnight requires consent. I wrote more about this in https://www.jefftk.com/p/why-so-many-cookie-banners and the relevant guidelines are section 2.3 of https://ec.europa.eu/justice/article-29/documentation/opinio...

Why would it matter if you take 1 minute or 1 day? Either way, the baseline expectation of functionality is for state to persist from one page request to the next page request, no matter how short or long that interval happens to be, and some kind of local storage (typically a cookie) facilitates that for both cases equally. Is it just to replicate the experience of that for which an online cart is a metaphor: with a physical shopping cart, a store employee will empty it out if it's abandoned overnight unless you explicitly ask them to hold it?

It matters because a browser may be shared between different users and a persistent shopping cart is a leak of private information.

Interesting. I feel like if you decide to share your OS session (and therefore your browser data which goes well beyond that cart: things like the passwords it offered to save!) all hope is already lost when it comes to isolation between users.

Thanks for the explanation - you learn something new every day.

You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?

Yes, if you only need consent for the cart then matching the notification to the action is nice.

I don't see how this:

>> You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?

would count as consent under EU standards. I thought consent had to be indicated unambiguously. Clicking an "add to cart" button only unambiguously indicates that the user wants to add the item to their card, not that they are consenting to (or have even noticed) some footnote below the button.

I think you're taking the interpretation quite far in your post. I've seen legal department giving approval for a much less strict interpretation - basically on the level of "is this cookie realistically useful for this specific purpose". It would be useful to get some real cases that answer those questions, because on one extreme, "strictly" you don't need any local browser storage at all - the product page can contain a form to print out for a mail order and you can track your cart on paper.

Realistically speaking, nobody is getting in trouble over this, so feel free to ignore and set your shopping carts to 30 days or a year or whatever.

There are much bigger breaches of the GDPR/ePrivacy out there and entire businesses built upon them and they keep operating in total impunity.