3 ms·
From GDPR.eu: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of
by jchw 6y ago
From GDPR.eu:
> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
Seems like you can in fact set first-party session tokens without consent. Does not seem like you need a specific reason to do so.
- g_p 6y agoOnly if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though. https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... So I'd argue it does need to be a specific reason, at least if you follow the ICO guidance (which is probably the best I've found for explaining what's required by the ePrivacy directive)
- jchw 6y agoStrictly necessary can also include security measures, of which session IDs tend to be a part of.