3 ms·

how to make a website sans cookies: don't use cookies. saved you all a click.

raxxorrax 6y ago
You could use localstorage and a script for setting/getting the info via xmlhttp. Technically not a cookie and there is nothing automatically send. I think cookies are great if they weren't abused as much. (not saying the site is using any alternative approaches, I think their ambition is laudable)
- cseleborg 6y ago
  I believe localStorage is equivalent to cookies as far as the European cookie banner directive is concerned.
  - volument 6y ago
    The eDirective states that the browser and device information (like the URL) is private data and you need a permission to access it for non-essential purposes such as analytics. This is why Simple Analytics also needs a cookie banner, contrast to what their marketing says.
    - Vespasian 6y ago
      I'm not quite up to date, was it passed since 2018? I remember it being delayed quite a bit. My Google-Fu has proved insufficient.
      - volument 6y ago
        EU is still working on a new version of the directive. I heard they have been doing it for three years now.
cseleborg 6y ago
Well... turns out, it's not that easy. I, too, removed the cookies from my website [1] and was thrilled to finally get rid of the cookie banner, but had to jump through some hoops: - It's a WooCommerce store. WooCommerce stores one persistent cookie to keep track of your cart. I had to hack up a little snippet of PHP code to turn that into a session cookie. It's not quite documented behavior, but the hack feels robust enough that I can live with it. (Sessions cookies are allowed, as per GDPR.) - YouTube embeds had to go, as even their youtube-nocookie domain sets cookies (thanks, YT). Vimeo has a "dnt" option that seems close to what I want, but it still sets some ID in localStorage, which the GDPR views as equivalent to cookies in this regard. So my current workaround is to just have the video thumbnail and link to the proper video on YT, but that sucks because now my visitors leave the website. - Replaced Google Analytics with self-hosted Matomo, carefully configured to not set cookies (it's not trivial), which now regularly brings my cheap hosted server to the limit ;-) So even a relatively simple website that does little fancy is not easy to get free of cookies. [1] https://dascask.com https://dascask.com
- tleb_ 6y ago
  > Sessions cookies are allowed, as per GDPR. Would you have a source? Reading through this page[0] I don't get the impression this is right. Session cookies are cookies nonetheless that can be used to identify users and if they are used that way, consent should be asked and given before usage. [0]: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/

You could use localstorage and a script for setting/getting the info via xmlhttp. Technically not a cookie and there is nothing automatically send. I think cookies are great if they weren't abused as much. (not saying the site is using any alternative approaches, I think their ambition is laudable)

cseleborg 6y ago
I believe localStorage is equivalent to cookies as far as the European cookie banner directive is concerned.
- volument 6y ago
  The eDirective states that the browser and device information (like the URL) is private data and you need a permission to access it for non-essential purposes such as analytics. This is why Simple Analytics also needs a cookie banner, contrast to what their marketing says.
  - Vespasian 6y ago
    I'm not quite up to date, was it passed since 2018? I remember it being delayed quite a bit. My Google-Fu has proved insufficient.
    - volument 6y ago
      EU is still working on a new version of the directive. I heard they have been doing it for three years now.

cseleborg 6y ago

Well... turns out, it's not that easy. I, too, removed the cookies from my website [1] and was thrilled to finally get rid of the cookie banner, but had to jump through some hoops: - It's a WooCommerce store. WooCommerce stores one persistent cookie to keep track of your cart. I had to hack up a little snippet of PHP code to turn that into a session cookie. It's not quite documented behavior, but the hack feels robust enough that I can live with it. (Sessions cookies are allowed, as per GDPR.) - YouTube embeds had to go, as even their youtube-nocookie domain sets cookies (thanks, YT). Vimeo has a "dnt" option that seems close to what I want, but it still sets some ID in localStorage, which the GDPR views as equivalent to cookies in this regard. So my current workaround is to just have the video thumbnail and link to the proper video on YT, but that sucks because now my visitors leave the website. - Replaced Google Analytics with self-hosted Matomo, carefully configured to not set cookies (it's not trivial), which now regularly brings my cheap hosted server to the limit ;-) So even a relatively simple website that does little fancy is not easy to get free of cookies. [1] https://dascask.com https://dascask.com

tleb_ 6y ago
> Sessions cookies are allowed, as per GDPR. Would you have a source? Reading through this page[0] I don't get the impression this is right. Session cookies are cookies nonetheless that can be used to identify users and if they are used that way, consent should be asked and given before usage. [0]: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/