If a user has an account (e.g. to log in) then surely you can make them consent to cookies to track their login your terms of service?

Stil think it's a nonsense law though ..