Only data that is used in external calls must be taint checked. For example, when a name is put in a cookie, just for fun, there's absolutely no reason to taint check it

Absolutely no reason to taint check? What if the name they give you contains "\r\n"? If you blindly copied that name into a Set-Cookie header, someone could insert arbitrary HTTP headers and HTML content into your output with a cross-site scripting attack.

you should think about encoding it, though

Encoding will solve this problem in most cases. CGI.pm automatically url-escapes cookie contents, which is yet another reason to always use it.