I'm live in eu so the GDPR applies, I gess this is legal because it's a big website. So far I have found one another site using the same technique.
Do you use other website with the same behavior? This completely blew my mind; If we disable cookies on this website it's working well, but everyone don't know that we can do this. Theses websites makes people think cookies are only controlled "server side"