Within the European Union we are requested by law (General Data Protection Regulation & ePrivacy directive) to provide information to the user of any online application of the cookies that are used, and reveive consent when using not strictly necessary cookies (see fill complience text below).
All sites and application in ArcGIS Online and Portal for ArcGIS should include this possibility: show cookies used + ask consent for not strictly necessary cookies.
Most important is Hubs when combined with google analytics, where you definately need consent by the user for placing tracking cookies.
=============================
Cookie compliance
To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
- Receive users’ consent before you use any cookies except strictly necessary cookies.
- Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
- Document and store consent received from users.
- Allow users to access your service even if they refuse to allow the use of certain cookies
- Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.
(source: https://gdpr.eu/cookies/ )
