I guess you could resort to something like evercookie, but without the actual
cookie and just use the other techniques.
My laymans interpretation says you can place cookies on someones machines if they explicitly request for you to render them a service and the cookie is required for the service to function. Like clicking the
Login button on a web page. It is trying to exclude secret cookies that the users didn't ask for and don't know exist.
This would be a useless law in the US, as every advertiser would argue that clicking on the link to load the page would be explicitly requesting the ads on the page, and that the cookies they place on your machine were explicitly requested with the simple action of visiting a
URL. EU might be different, it looks pretty technically un-enforceable to me.