Cookie notices are required if you for example use them to pass data to third parties.

A login cookie that is just for auth is not that. It is specifically requested by the user and implies that the user's data is managed on that site and can be evicted.

Same with analytics. The problem is not that you're doing analytics. It's that the user doesn't know that your doing it and that you're passing on that data to a third party.

> I've never ever seen a cookie notice on HN, which is legally required.

For clarity: it isn't always required. Only if you have third party (tracking) cookies.

I don't know about HN. But its perfectly possible to have analytics, ads and other functional cookies, without pestering your users with cookie popups.

Again: cookie popups and concent-banners aren't required. They are only required if you have "invasive" tracking in place.

e.g. I've worked on web-apps that were tracked by a selfhosted matomo, by plausible or some other tracking, that did not have any GTM or other tag-managers, that had no ads or only ads which were served from their own domain and without any 3rd party trackers, lacked all the GAFAM-pixels, had their fonts and other assets self-hosted (or on a simple, non-tracking CDN) and so on. Non of these needed any form of banner, popup or wizard.

I don't think you are right. Right now, the only cookie present is my session cookie. This should fall under obvious reason to have a cookie (it's not a tracking cookie). The sets of required and of all cookies are identical. Therefore, a dialog like this changes nothing.

> I've never ever seen a cookie notice on HN, which is legally required.

What for? The GDPR does not require consent for purely functional cookies, and the only data I see stored is my account cookie. So the existing privacy policy should cover them.

It's illegal for you to provide a service that isn't compliant. So if you use Stripe, therefore transfer data to a non-compliant country, you would be illegally providing a service that isn't complaint.

Also, the cookie notice is not GDPR it's a separate law. And if you only use functional cookies such as login cookies no notice is required.