After checking with our engineering team, I do need to correct myself on what I wrote before - I was getting two features mixed up.
You’re right that the cookie consent plugin just offers an FYI banner, based on the version of Osano that we’ve implemented there. So you’re also correct that this is not enough.
The other feature I got mixed up with, which should be much more helpful for GDPR compliance, is the checkbox found in Settings > General called “Do not set cookies on new users by default”. If you check this box, any visitor to your app will not get any Bubble cookies - which also means they will not get a temporary user ID. When you’re using this setting, you can also use the workflow action “Opt-in to cookies”.
The combination of these two means that you can build an experience where no users get cookies, but you can show some kind of consent element that, when the user gives consent, then turns on cookies.
(Note also that there’s a workflow action to opt out of cookies when you’re using this setting. That takes care of being able to withdraw cookie consent.)
When you’re using this setting, the user is still able to navigate around your Bubble app - but you as the creator are in control of what that experience looks like for a non-cookied user.
Bubble itself sets a certain handful of cookies which are necessary for Bubble to behave properly with a logged-in experience. Cloudflare also sets a cookie which I believe is generally regarded as necessary (and not used for things like analytics, personalization, marketing, etc.). More information about these cookies can be found here.
So in short, the above feature is what you’d use to build a user flow where visitors can consent to cookies.
Bubble does not have the feature to create categories of cookies with finer grained controls over each. But, you as the app creator do have control over which plugins you use - and some plugins will influence which cookies your app sets. (I am double checking with our legal counsel on whether the EU’s stance on controls by cookie category has changed recently.)
(The original blog post of this thread had the above feature listed, but I’m editing it now to account for the information that yusaney1 has highlighted here.)