Right, that’s (unfortunately) what I’m doing now.
I’m really curious how you read that document then. I mean, 3.2 Authentication Cookies lays it out pretty clearly:
Authentication cookies are used to identify the user once he has logged in (example: on an
online banking website). These cookies are needed to allow users to authenticate themselves
on successive visits to the website and gain access to authorized content, such as viewing their
account balance, transactions, etc. Authentication cookies are usually session cookies. The
use of persistent cookies is also possible but they must not be regarded as identical, as
discussed below.
Recognizes the need for authentication cookies (note, not named technical cookies). Explicitly states that lifetime of these cookies, i.e. session vs persistent, implies them to be treated differently.
When a user logs in, he explicitly requests access to the content or functionality to which he is
authorized. Without the use of an authentication token stored in a cookie the user would have
to provide a username/password on each page request. Therefore this authentication
functionality is an essential part of the information society service he is explicitly requesting.
As such these cookies are exempted under CRITERION B.However it is important to note that the user has only requested access to the site and specific
functionality to perform the task he requires. The act of authentication must not be taken as an
opportunity to use the cookie for other secondary purposes such as behavioural monitoring or
advertising without consent.
Logging in means the user provided consent to being logged in, not for other types of data usage through any authentication cookies set.
Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be
immediately aware of the fact that closing the browser will not clear their authentication
settings. They may return to the website under the assumption that they are anonymous whilst
in fact they are still logged in to the service. The commonly seen method of using a checkbox
and a simple information note such as “remember me (uses cookies)” next to the submit form
would be an appropriate means of gaining consent therefore negating the need to apply an
exemption in this case.
CRITERION B being:
the cookie is “strictly necessary in order for the provider of an information
society service explicitly requested by the subscriber or user to provide the service”.
So the user needs to provide consent before persistent authentication cookies may be set. Reason: you cannot expect a user to know the implications of persistent authentication by default.
Yes, the legislation is diffuse and complex, with many different updates over two decades almost. And even the official EU sites I looked into seem to be very messy when it comes to how they handle cookies and their stated policies.