3 ms·

I'm specifically talking about the GDPR which is the cause of all the popups we're seeing (but to be clear, doesn't require a popup), not the earlier "cookie la

by wlll 6y ago

I'm specifically talking about the GDPR which is the cause of all the popups we're seeing (but to be clear, doesn't require a popup), not the earlier "cookie law", which I agree is crap, and that you linked to. However, that law does state that you don't need to get permission if the cookie is: "Strictly necessary to provide a service explicitly requested by the user"

AmericanChopper 6y ago
Which doesn't cover: A cookie that remembers your shopping cart if you leave the site and return to it later. A cookie that remembers any preference you register if you leave a site and return to it later. A login cookie that persists after you leave the site doesn't explicitly require consent, but if you don't get it, then you are technically deviating from the guidelines that "[strictly necessary cookies] will generally be first-party session cookies" and that session cookies are "temporary and expire once you close your browser (or once your session ends)". If you had a persistent auth cookie, it would be reasonable to lean towards consent based on the published guidance. from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in. > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. Your stated understanding of when consent is and is not required is simply incorrect.
- wlll 6y ago
  > Receive users’ consent before you use any cookies except strictly necessary cookies. Yup. > login cookies Put an unchecked "Remember me" checkbox on your login page and link to your cookie/privacy policy. This is a good idea anyway as the user might be on a shared computer. > Preferences cookies Allowed to be persistent as long as they don't contain user identifiable information. > A cookie that remembers your shopping cart if you leave the site and return to it later. I couldn't find any specific guidance on this, so it seems reasonable to use a cookie that might last a few hours or so, then have a talk to your local Information Commissioners Office if someone complains.
  - AmericanChopper 6y ago
    Preference cookies are not allowed to persist without consent. Not only is your interpretation of the regulations very highly opinionated, but it’s just outright wrong on some points. Your assertion that anybody who deviates from your opinions on the regulation, or doesn’t share your misunderstandings must be abusing data by asking for a cookie consent is frankly ridiculous. The guidelines also state that even for Strictly Necessary cookies, the site must explain why they are necessary, something your canonical example of a good site fails to do.
    - wlll 6y ago
      > Preference cookies are not allowed to persist without consent. OK, I am willing to be educated, point me at the place in the regulations this is discussed. > Not only is your interpretation of the regulations very highly opinionated, but it’s just outright wrong on some points. s/opinion/interpretation/ > The guidelines also state that even for Strictly Necessary cookies, the site must explain why they are necessary, something your canonical example of a good site fails to do. You don't need to do this in a cookie popup consent dialog. You are welcome to carry on thinking this if you want to though obviously.
      - AmericanChopper 6y ago
        > Preference cookies are not allowed to persist without consent. > OK, I am willing to be educated, point me at the place in the regulations this is discussed. It is not discussed, it is stated very explicitly: >(66) Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities. https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:0036:En:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:... If you want to persist any preference information, you must get explicit consent. Whether you use that information for tracking or not, or whether it is combined with PII or not, has absolutely no bearing on your obligation. The act of persisting that information in the users browser requires consent. As this is a directive, it will be implemented independently by every member state, so if you want specific guidance for a specific state, you'll have to look it up. I linked the UKs guidance on this to you above, which you ignored. The facts are: > If you want to persist any preference information, you must gain explicit consent > The existence of cookie consent dialog is not a sign of malfeasance > Lack of a cookie consent dialog is not a sign of lack of malfeasance > Your stated interpretation of the regulations is very highly opinionated, and not supported by any jurisprudence > Some of your stated interpretations are just demonstrably wrong > The actual regulation is almost never followed Based on those facts I would argue that the regulation has provided no benefit to the public at all, and has simple created a global nuisance that we all have to put up with now.

by wlll 6y ago

AmericanChopper 6y ago

Which doesn't cover: A cookie that remembers your shopping cart if you leave the site and return to it later. A cookie that remembers any preference you register if you leave a site and return to it later. A login cookie that persists after you leave the site doesn't explicitly require consent, but if you don't get it, then you are technically deviating from the guidelines that "[strictly necessary cookies] will generally be first-party session cookies" and that session cookies are "temporary and expire once you close your browser (or once your session ends)". If you had a persistent auth cookie, it would be reasonable to lean towards consent based on the published guidance. from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in. > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. Your stated understanding of when consent is and is not required is simply incorrect.

wlll 6y ago
> Receive users’ consent before you use any cookies except strictly necessary cookies. Yup. > login cookies Put an unchecked "Remember me" checkbox on your login page and link to your cookie/privacy policy. This is a good idea anyway as the user might be on a shared computer. > Preferences cookies Allowed to be persistent as long as they don't contain user identifiable information. > A cookie that remembers your shopping cart if you leave the site and return to it later. I couldn't find any specific guidance on this, so it seems reasonable to use a cookie that might last a few hours or so, then have a talk to your local Information Commissioners Office if someone complains.
- AmericanChopper 6y ago
  Preference cookies are not allowed to persist without consent. Not only is your interpretation of the regulations very highly opinionated, but it’s just outright wrong on some points. Your assertion that anybody who deviates from your opinions on the regulation, or doesn’t share your misunderstandings must be abusing data by asking for a cookie consent is frankly ridiculous. The guidelines also state that even for Strictly Necessary cookies, the site must explain why they are necessary, something your canonical example of a good site fails to do.
  - wlll 6y ago
    > Preference cookies are not allowed to persist without consent. OK, I am willing to be educated, point me at the place in the regulations this is discussed. > Not only is your interpretation of the regulations very highly opinionated, but it’s just outright wrong on some points. s/opinion/interpretation/ > The guidelines also state that even for Strictly Necessary cookies, the site must explain why they are necessary, something your canonical example of a good site fails to do. You don't need to do this in a cookie popup consent dialog. You are welcome to carry on thinking this if you want to though obviously.
    - AmericanChopper 6y ago
      > Preference cookies are not allowed to persist without consent. > OK, I am willing to be educated, point me at the place in the regulations this is discussed. It is not discussed, it is stated very explicitly: >(66) Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities. https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:0036:En:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:... If you want to persist any preference information, you must get explicit consent. Whether you use that information for tracking or not, or whether it is combined with PII or not, has absolutely no bearing on your obligation. The act of persisting that information in the users browser requires consent. As this is a directive, it will be implemented independently by every member state, so if you want specific guidance for a specific state, you'll have to look it up. I linked the UKs guidance on this to you above, which you ignored. The facts are: > If you want to persist any preference information, you must gain explicit consent > The existence of cookie consent dialog is not a sign of malfeasance > Lack of a cookie consent dialog is not a sign of lack of malfeasance > Your stated interpretation of the regulations is very highly opinionated, and not supported by any jurisprudence > Some of your stated interpretations are just demonstrably wrong > The actual regulation is almost never followed Based on those facts I would argue that the regulation has provided no benefit to the public at all, and has simple created a global nuisance that we all have to put up with now.