Why So Many Cookie Banners?

Maintaining a shopping cart across days isn't "strictly necessary"

This seems like an extremely draconian interpretation of the law. I'd say that maintaining a shopping cart across days is a legitimate part of a service the user requested, and while multi-day shopping carts are not "strictly necessary" for the service as a whole, cookies are strictly necessary for that part.

Notably, the website of the Court of Justice of the European Union itself stores cookies for "display preferences, such as language, contrast colour settings or font size" automatically without the user being able to opt out. This is pretty strong circumstantial evidence to me that doing so is actually okay.

To find out what interpretation is correct I'd like to see some actual court case where it's discussed. From my cursory search online, the violations (e.g.) seem to be a lot more flagrant than this.

In any case the question of why the cookie banners are so common has a simpler explanation, I think. Websites don't really know much more of the law than we do, and they don't have the time or skill to evaluate their entire web tech stack for potential issues. In the end they err on the side of caution by copying what others do, in what's partially carefulness and partially cargo-cult.

How about the possibility of malicious compliance? Companies have obnoxious cookie banners to 1) make the path of least resistance accepting all the cookies and 2) as a bonus, serve as propaganda against the cookie directive.

And among the companies who aren't doing it for malicious compliance, many of them may be copying ideas from companies who do without realizing why they do it.

I'm slightly privacy-obsessed and my browser is configurated to always throw away all cookies every time I close the session. For me (and presumably for those who wrote the EU regulation), seeing lots of annoying banners is way more acceptable than having my navigation data stored away by unknown actors without my consent.

The spirit of the norm is quite clear: you can use a cookie without consent if the service would not function at all without that cookie. This basically means that session cookies for recognizing logged users are okay, and everything else is probably not. No matter what the SEO guy says, a tracker cookie for site analytics is not strictly necessary for the service to be provided. I hold the view that single-page sites without authentication features should not require cookies at all (I've personally designed sites without cookies for small conferences, it's not a mortal sin to use pure HTML).

The overall effect of this is that most sites will not be ePrivacy-compliant unless they either (a) get cookie consent from users or (b) hire a lawyer to review each of the things they do in the context of ePrivacy, and make careful changes to keep everything within the tight bounds of "strictly necessary".

Asking for consent does not allow you to escape having to decide which cookies are necessary and which aren't. After the DSGVO, it's not enough to ask "is it okay that we store cookies on your computer". The user has to be informed about the purposes of the cookies and be able to say "I don't want unnecessary cookies". 

if I put things in my cart, don't check out, and come back the next day, I'm going to be frustrated if the site has forgotten my selections!

Ironically, I get frustrated by the inverse of this. If I put something in my shopping cart, I definitely don’t still want it tomorrow. I keep on accidentally having items that I don’t want in my order when I check out, and then I have to go back through all the order steps to remove the item (since there’s hardly ever a removal button from the credit card screen). It’s so frustrating! I don’t want you to remember things about me from previous days, just get rid of it all.

Why do non-EU-based companies/websites bother to comply with this directive? For that matter, why do even big firms with an EU presence comply? I can see why a firm with an EU office or employees might worry about some legal risk, but (a) is it really true that the EU would devote significant enforcement resources to prosecuting/fining "victimless" violations of this directive? (b) for sufficiently popular websites (Amazon, FB, ...) surely the companies have more leverage than the EU, since I'd think that one of these firms even threatening to stop serving European customers (or employing EU programmers for that matter) would cause vastly more political backlash compared to the amount of genuine political support for the (policy motivation behind the) annoying cookie banners.

I guess simple text based browsers and websites that just show the minimal information you want in a way the user can control are not cool enough, and so we have all those EU regulations that "solve" a problem by making it worse.