All of that is true. However I doubt you could claim "opt in" because the user's browser accepted the cookie. It's not that easy to get around the letter and spirit of the law.