3 ms·

> But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them an

> But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to. It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking. I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them. All in all, it's pretty sad.

ddalex 8y ago
So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
- pdpi 8y ago
  > Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
  - dvfjsdhgfv 8y ago
    Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

ddalex 8y ago

So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.

pdpi 8y ago
> Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
- dvfjsdhgfv 8y ago
  Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm