The GDPR requires online businesses and websites to only collect, process, or analyze data after the individual has given their explicit agreement to the specific usage of cookies. This is the most used legal foundation that allows the website to collect, process, and analyze personal data using cookies.