4 ms·

I'm sure you know this, as you have included a bunch of pop-ups that aren't necessary but websites do anyway. But for other people who love to hate on the GDPR,

I'm sure you know this, as you have included a bunch of pop-ups that aren't necessary but websites do anyway. But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to.

josteink 8y ago
> But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to. It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking. I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them. All in all, it's pretty sad.
- ddalex 8y ago
  So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
  - pdpi 8y ago
    > Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
    - dvfjsdhgfv 8y ago
      Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
repolfx 8y ago
"You don't have to obey this law if you really need to violate it" is a common tactic in EU lawmaking and it's about as helpful as unlimited vacation policies are. Nobody knows how EU DPRs will define "need" and therefore, to be safe, you just always show the warning. The cost of the warning is low. The cost of being found in violation is high. Avoiding this sort of outcome is basic stuff, law-making 101, but the EU's output of low quality rule-by-law not rule-of-law regulations makes it seem like they either don't know or don't care.
- DanBC 8y ago
  > "You don't have to obey this law if you really need to violate it" is a common tactic in EU lawmaking and it's about as helpful as unlimited vacation policies are. That isn't the claim. The claim is that a bunch of cookies are specifically exempt from the law and the law tells you that you don't need to put up cookie banner click-throughs. And also that everyone ignores that, and puts up the banner click-throughs anyway and then moans about EU law.
mmusson 8y ago
I’m struck by how many of these sites are for news and newspapers.

josteink 8y ago

> But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to. It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking. I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them. All in all, it's pretty sad.

ddalex 8y ago
So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
- pdpi 8y ago
  > Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
  - dvfjsdhgfv 8y ago
    Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

repolfx 8y ago

"You don't have to obey this law if you really need to violate it" is a common tactic in EU lawmaking and it's about as helpful as unlimited vacation policies are. Nobody knows how EU DPRs will define "need" and therefore, to be safe, you just always show the warning. The cost of the warning is low. The cost of being found in violation is high. Avoiding this sort of outcome is basic stuff, law-making 101, but the EU's output of low quality rule-by-law not rule-of-law regulations makes it seem like they either don't know or don't care.

DanBC 8y ago
> "You don't have to obey this law if you really need to violate it" is a common tactic in EU lawmaking and it's about as helpful as unlimited vacation policies are. That isn't the claim. The claim is that a bunch of cookies are specifically exempt from the law and the law tells you that you don't need to put up cookie banner click-throughs. And also that everyone ignores that, and puts up the banner click-throughs anyway and then moans about EU law.

mmusson 8y ago

I’m struck by how many of these sites are for news and newspapers.