Mandatory under PECR. Must list each cookie set, its purpose, duration and provider, and be paired with a consent banner that obtains consent before non-essential cookies are set.