4 ms·
No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but ma
by yladiz 6y ago
No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but may not be tied to a particular user. Segment, at least using just for analytics, isn’t necessary for the function of a website or app, so even if the cookies don’t have any PII you still need to get consent.
You’re right that you don’t need permission to set server session cookies, but that is because that cookie is essential for the function of an authenticated app.
- TheRealPomax 6y agoNo, you don't: GDPR makes zero stipulations about that, and only requires consent if you're dealing with cookies that either contain PII, or themselves act as PII for cross-site tracking purposes. Sites are entirely free to set as many cookies as they like for any and all "non-essential" site purposes because anything in place to make a website work can be trivially argued in any court to be essential to running that particular business in the most cost effective manner: page metrics, heat maps, front door proxying, A/B testing, optimization etc. are all part of running a business on the web. Whether you as user consider that essential, or what your opinion is on what qualifies as "cost effective" is entirely irrelevant. Will the site work without an analytics cookie, and an optimizely cookie, and a cloudfront cookie, etc. ? Sure. But if a business decides they need a service that needs cookies set to work properly, as long as no PII is involved, that is not GDPR's concern in the slightest.
- iamacyborg 6y agoGDPR may not apply, but regulations like PECR do - and they will frequently require consent as defined by the GDPR.