I would draw the line where my personal data is exchanged with third parties for the purpose of monetisation. I want the websites I visit to be islands that do not contribute to anyone's attempt to create a complete profile of my online (and indeed offline) life.

I don't care about anything else. They can do whatever A/B testing they want as far as I'm concerned. They can analyse my user journey across multiple visits. They can do segmentation to see how they can best serve different groups of users. They can store my previous search terms, choices and preferences. If it's a shop, they can rank products according to what they think might interest me based on previous visits. These things will likely make the site better for me or at least not much worse.

Other people will surely disagree. That's fine. What's more important than where exactly to draw the line is to recognise that there are trade-offs.

The law seems to be making an assumption that the less sites can do without asking for consent the better most people's privacy will be protected.

But this is a flawed idea, because it creates an opportunity for sites to withhold useful features from people unless and until they consent to a complete loss of privacy.

Other sites that want to provide those features without complete loss of privacy cannot distinguish themselves by not asking for consent.

Part of the problem is the overly strict interpretation of "strictly necessary" by data protection agencies. There are some features that could be seen as strictly necessary for normal usability (such as remembering preferences) but this is not consistently accepted by data protection agencies so sites will still ask for consent to be on the safe side.