5 ms·

Do these laws apply to browser local storage and all other ways to save info? And once a user says "no" to cookies/tracking how is that saved, in a cookie?

by ape4 6y ago

zinekeller 6y ago
As may have pointed out, GDPR does not focus on cookies per se, but Amazon (previously) and Google has put tracking cookies even while declining them. The point is Google is not putting only the "I have opt out" cookie, but putting instead "I have opt out and my ID is 751DBC849846494494A894984" cookie (which is the issue at hand). Edit: this should be opt-in really, as tracking is explicitly stated as a consensual activity.
TheCoelacanth 6y ago
The technical means that you use to accomplish tracking doesn't matter at all. Even server-side storage is covered. Storing a cookie that says the the user opted out of tracking is perfectly fine. GDPR isn't about cookies. It's about tracking of personal information.
lmkg 6y ago
GDPR covers personal information, regardless of when or where it's stored. The ePrivacy Directive (which is called the "EU Cookie Law," the same way that the ACA is called "Obamacare") covers reading or writing data from a user's terminal device. That will include cookie-equivalents like local storage. In fact, because it covers "reading" separate from "writing," it also includes reading browser settings like user-agent string or location/language headers, and 99% of fingerprinting techniques. Cookies require consent unless they are essential to the service that was requested by the user. The canonical example is using a cookie to manage a user's shopping cart on an ecommerce site. Shopping is what the user has requested to do, a cookie (or moral equivalent) is basically necessary to do that, no consent required. By extension, denying cookies is a positive action taken by the user directing the site to alter its behavior. If a cookie is needed to perform that task, it's allowed even if cookie consent has otherwise been denied.

Do these laws apply to browser local storage and all other ways to save info? And once a user says "no" to cookies/tracking how is that saved, in a cookie?

by ape4 6y ago

Do these laws apply to browser local storage and all other ways to save info? And once a user says "no" to cookies/tracking how is that saved, in a cookie?

zinekeller 6y ago

As may have pointed out, GDPR does not focus on cookies per se, but Amazon (previously) and Google has put tracking cookies even while declining them. The point is Google is not putting only the "I have opt out" cookie, but putting instead "I have opt out and my ID is 751DBC849846494494A894984" cookie (which is the issue at hand). Edit: this should be opt-in really, as tracking is explicitly stated as a consensual activity.

TheCoelacanth 6y ago

The technical means that you use to accomplish tracking doesn't matter at all. Even server-side storage is covered. Storing a cookie that says the the user opted out of tracking is perfectly fine. GDPR isn't about cookies. It's about tracking of personal information.

lmkg 6y ago

GDPR covers personal information, regardless of when or where it's stored. The ePrivacy Directive (which is called the "EU Cookie Law," the same way that the ACA is called "Obamacare") covers reading or writing data from a user's terminal device. That will include cookie-equivalents like local storage. In fact, because it covers "reading" separate from "writing," it also includes reading browser settings like user-agent string or location/language headers, and 99% of fingerprinting techniques. Cookies require consent unless they are essential to the service that was requested by the user. The canonical example is using a cookie to manage a user's shopping cart on an ecommerce site. Shopping is what the user has requested to do, a cookie (or moral equivalent) is basically necessary to do that, no consent required. By extension, denying cookies is a positive action taken by the user directing the site to alter its behavior. If a cookie is needed to perform that task, it's allowed even if cookie consent has otherwise been denied.