There is so much confusion, uncertainty and general lack of understanding about this, and nothing is going to happen immediately in terms of 'fines' and the ICO clamping down. Reading a Q&A at econsultancy I can't link to, but google "econsultancy q&a dave evans" my view is:
- Carry out a simple cookie audit
- Make the results of this much clearer on your site
It doesn't have to be a pop up as soon as someone comes onto your site, just clear enough, in the header, sidebar etc. Yes, this isn't 100% 'compliant', but then there aren't many sites that are, and what the ICO are looking for right now is evidence that companies are moving forward with this.
The bigger emphasis on this is about customer knowledge, as currently the wider public have little idea about cookies, and site owners need to help them understand.
The two biggest quotes in that q&a for me are:
(Regarding the customer, should they complain about a site) - "The first question we will ask is: have you tried to sort this out yourself? If they dont want a particular cookie, then they could use browser settings or security software to get rid of it."
And
"In these situations we would be more likely to provide advice to the organisation. It is unlikely (though not impossible) that we would take action just for analytics cookies."
Don't panic about this, but also don't just ignore it and shout about it being unworkable. There are difficulties if you take the legislation literally, but move towards compliance and inform your customers quietly and you won't have any problems IMO