5 ms·

One minute wasted watching this and it doesn't even show the contents of those cookies. Without looking at the contents, it's impossible to tell if they are "ne

One minute wasted watching this and it doesn't even show the contents of those cookies. Without looking at the contents, it's impossible to tell if they are "necessary for site functionality", for which you do not need consent (as you can see in the video, there is no checkbox for that sort of cookies, they are always active).

mikrosom 6y ago
Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?
- TonyTrapp 6y ago
  Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.
  - mjlawson 6y ago
    This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.
  - whimsicalism 6y ago
    > Slack has no control over those cookies Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?
- yonixw 6y ago
  Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.
  - Nextgrid 6y ago
    Unless there's actually a captcha on that page, they aren't essential. Furthermore, you could argue that recaptcha itself is in breach of the GDPR as it collects a lot more data than necessary (captchas have been done just fine for decades without collecting any personal information).
    - SquareWheel 6y ago
      That isn't how reCaptcha works though. v3 doesn't even show challenges anymore. It wouldn't work at all without analyzing user metrics.
      - iamacyborg 6y ago
        Well then maybe it's not compliant with data protection legislation if they need to analyse user behaviour without consent.
  - avian 6y ago
    From my perspective as a user making me click those traffic lights isn't essential functionality.
    - yonixw 6y ago
      But for the business, bot protection is essential. And GDPR talks about business perspective.
      - iamacyborg 6y ago
        GDPR talks about balancing business interests against individual rights.
      - g_p 6y ago
        When placing cookies, the bar to essential is actually really high. It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality. The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here! https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
deleted 6y ago
[deleted]
0df8dkdf 6y ago
No cookies are 'necessary' for site functionality, unless there is a login needed. No cookies are 'necessary' to just display information, pics and videos.
- jchw 6y ago
  From GDPR.eu: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. Seems like you can in fact set first-party session tokens without consent. Does not seem like you need a specific reason to do so.
  - g_p 6y ago
    Only if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though. https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... So I'd argue it does need to be a specific reason, at least if you follow the ICO guidance (which is probably the best I've found for explaining what's required by the ePrivacy directive)
    - jchw 6y ago
      Strictly necessary can also include security measures, of which session IDs tend to be a part of.
- merb 6y ago
  bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

mikrosom 6y ago

Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?

TonyTrapp 6y ago
Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.
- mjlawson 6y ago
  This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.
- whimsicalism 6y ago
  > Slack has no control over those cookies Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?
yonixw 6y ago
Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.
- Nextgrid 6y ago
  Unless there's actually a captcha on that page, they aren't essential. Furthermore, you could argue that recaptcha itself is in breach of the GDPR as it collects a lot more data than necessary (captchas have been done just fine for decades without collecting any personal information).
  - SquareWheel 6y ago
    That isn't how reCaptcha works though. v3 doesn't even show challenges anymore. It wouldn't work at all without analyzing user metrics.
    - iamacyborg 6y ago
      Well then maybe it's not compliant with data protection legislation if they need to analyse user behaviour without consent.
- avian 6y ago
  From my perspective as a user making me click those traffic lights isn't essential functionality.
  - yonixw 6y ago
    But for the business, bot protection is essential. And GDPR talks about business perspective.
    - iamacyborg 6y ago
      GDPR talks about balancing business interests against individual rights.
    - g_p 6y ago
      When placing cookies, the bar to essential is actually really high. It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality. The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here! https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

deleted 6y ago

[deleted]

0df8dkdf 6y ago

No cookies are 'necessary' for site functionality, unless there is a login needed. No cookies are 'necessary' to just display information, pics and videos.

jchw 6y ago
From GDPR.eu: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. Seems like you can in fact set first-party session tokens without consent. Does not seem like you need a specific reason to do so.
- g_p 6y ago
  Only if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though. https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... So I'd argue it does need to be a specific reason, at least if you follow the ICO guidance (which is probably the best I've found for explaining what's required by the ePrivacy directive)
  - jchw 6y ago
    Strictly necessary can also include security measures, of which session IDs tend to be a part of.
merb 6y ago
bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.