The words of the law are actually not supporting the spirit of the law, at least when passing data to Google is concerned. Data protection can not be enforced with messing with cookies. EU should focus its influence on ensuring that companies operating in EU (like Google) respect user's privacy - including not passing data to third parties, like NSA.