The argument that it is a crime comes down to arguments around what constitutes 'unauthorised access'.
As 'unauthorised access' to a computer system is a crime, if you make your definition of 'authorised' "access subject to our terms of use" : Huzzah! Violating your terms of use is now a crime!
This all comes back to laws written in wooly "the courts will work it out" language.
It's your own browser that interprets the header, saves the cookie, and passes it back to sites you visit. Passing a "here's a cookie" header to your machine doesn't, on its own, do anything. Your browser has to actively parse and store it.
By the same token, my sending an HTTP request to a server doesn't, on its own, do anything. Their server has to actively parse the request and send data.
The details are probably too complicated for an HN comment, but one point that sometimes gets missed is that you normally don't have the same disclosure/consent obligations for cookies that are essential to the normal operation of the site like login tokens or tracking what's in a shopping basket.
The argument that it is a crime comes down to arguments around what constitutes 'unauthorised access'.
As 'unauthorised access' to a computer system is a crime, if you make your definition of 'authorised' "access subject to our terms of use" : Huzzah! Violating your terms of use is now a crime!
This all comes back to laws written in wooly "the courts will work it out" language.