OP shouldn't have to use private browsing, that's the entire point of the regulation, and that does not prevent cookies from being used during a session anyway.
Potential behavioral fingerprinting via cross-analysis of sessions. The more important point is that OP should not have to change their habits if a company is maliciously complying with regulation; the regulation should be tightened.