3 ms·

It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are comp

It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.

that_guy_iain 6y ago
There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.
- cdrx 6y ago
  To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
  - that_guy_iain 6y ago
    Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.
  - matthewheath 6y ago
    > To be legal you need to get the user's consent, upfront, for that tracking. No, that's just one basis for processing data. Another basis for server-side tracking like this could be legitimate interest. The site will need to provide evidence that they've weighed up the user's interest in this and be able to demonstrate a convincing case in favour of the site. For example, it could be a legitimate interest to track A/B testing in order to increase shopping cart checkout rates - the legitimate interest is arguably that the site wants to increase its revenues and if it can demonstrate a convincing case for this, it will be allowed by the regulator.
    - cdrx 6y ago
      Storing a cookie which is not strictly necessary to provide the service, requires explicit consent. This is a PECR requirement, not a GDPR one. Tracking the source and campaign of a user between pages is not required to deliver the page. So you may rely on legitimate interest to process the data, but you need the consent to store the session cookie to collect the data in the first place.
      - that_guy_iain 6y ago
        If you have A/B testing in place it is strictly necessary to have a session cookie. Otherwise a user could end up in a case where they where in the A group on their first request but their second has them in the B group but the page they visited isn't enabled or displays different content than what they expected to see. If you have special offers based on the URl they came from then it is strictly necessary to be able to remember where they came from so they get the special offer and don't fall victim to false adverstising. Strictly necessary means if the website will break in anyway without it.
        cdrx 6y ago
        Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. You could a/b test based on even or odd numbered IP address and not require consent to store a cookie. You can pass the referrer around via query string and not require consent to store a cookie. However, as you said, there is no enforcement of the regulation so the risk of non-compliance is basically zero :)

that_guy_iain 6y ago

There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.

cdrx 6y ago
To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
- that_guy_iain 6y ago
  Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.
- matthewheath 6y ago
  > To be legal you need to get the user's consent, upfront, for that tracking. No, that's just one basis for processing data. Another basis for server-side tracking like this could be legitimate interest. The site will need to provide evidence that they've weighed up the user's interest in this and be able to demonstrate a convincing case in favour of the site. For example, it could be a legitimate interest to track A/B testing in order to increase shopping cart checkout rates - the legitimate interest is arguably that the site wants to increase its revenues and if it can demonstrate a convincing case for this, it will be allowed by the regulator.
  - cdrx 6y ago
    Storing a cookie which is not strictly necessary to provide the service, requires explicit consent. This is a PECR requirement, not a GDPR one. Tracking the source and campaign of a user between pages is not required to deliver the page. So you may rely on legitimate interest to process the data, but you need the consent to store the session cookie to collect the data in the first place.
    - that_guy_iain 6y ago
      If you have A/B testing in place it is strictly necessary to have a session cookie. Otherwise a user could end up in a case where they where in the A group on their first request but their second has them in the B group but the page they visited isn't enabled or displays different content than what they expected to see. If you have special offers based on the URl they came from then it is strictly necessary to be able to remember where they came from so they get the special offer and don't fall victim to false adverstising. Strictly necessary means if the website will break in anyway without it.
      - cdrx 6y ago
        Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. You could a/b test based on even or odd numbered IP address and not require consent to store a cookie. You can pass the referrer around via query string and not require consent to store a cookie. However, as you said, there is no enforcement of the regulation so the risk of non-compliance is basically zero :)