There's no need to use cookies for this when they control the backend. They know you're accessing a file because their server had to authenticate you.

What about sharing a link with an unauthenticated user? Last I checked, Drive lets you create a public download link for your files.

Hmm, yes, that's true. I wonder if that works with cookies disabled.