Hi Again,
Cookie usage / implementation is covered in depth in the e-privacy regulation which overrides the current law e-privacy directive - this series of rules was intended to come in to force at the same time as GDPR - it hasn't
https://www.techrepublic.com/article/gdpr-vs-eprivacy-the-3-differences-you-need-to-know/
At the moment as you say it requires consent for personalised data - however if the data is not personalised then consent is not required as the data can not be used to identify the user
In essence an audit is required to establish what data is actually collected for a users visit.
Information is taken from some apps by the social media applications for the purpose they were intended - here it again depends on data collected and how the user interacts with the social media plugins.
Then we have something called legitimate interest of the business to collect data >
Legitimate interests is the most flexible of the six lawful bases. It is not focused on a particular purpose and therefore gives you more scope to potentially rely on it in many different circumstances.
It may be the most appropriate basis when:
the processing is not required by law but is of a clear benefit to you or others;
there’s a limited privacy impact on the individual;
the individual should reasonably expect you to use their data in that way; and
you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.
This would apply to cookies that make the site work better both for the user and the site owner but it is not a get out of jail free card (so to speak)
If you want to stop many of these cookies on your site you can disable the social media elements. This will stop many cookies being used on your site
I am not disagreeing with your point regarding consent and site execution time as these are vitally important for a website
Depending on how case law / guidance develops I think most major sites will consider some kind of application splitting cookies into advertising, support, social and essential use - then people can choose what to disable and understand the implications of their choices
However many businesses may just do very little and wait for the e-privacy regulation to clearly define what is permitted usage without asking for consent and how technology develops e.g. how best to use anonymization or pseudonymization of data