You may think that EU privacy law requires cookie banners. But the law is clear: online tracking is prohibited by default.