4 ms·

AFAIK People inform about cookies when they don't have to. If you use cookies only for technical stuff (auth) then you do not have to inform about them and th

AFAIK People inform about cookies when they don't have to. If you use cookies only for technical stuff (auth) then you do not have to inform about them and that's why Github stopped doing it in last months iirc.

neals 5y ago
Is this true? That would be great.
- tester34 5y ago
  I think yea, but I didn't read all cookie related stuff >Operational cookies >There are some cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular: > authentication cookies > technical cookies required by certain IT systems https://ec.europa.eu/info/cookies_en https://ec.europa.eu/info/cookies_en
- szszrk 5y ago
  Well, yes, although this "for technical stuff" is quite vogue and misleading. Law actually states things "strictly necessary" don't need and agreement. So your auth session doesn't need anything, but your 3rd party monitoring software does. I wish this would be easier for me. A lot of sites on my market add disgusting banners even if they don't use cookies at all, or cookies were already created :) "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." I had a glance at my local interpretation it also states that it is not necessary to consent if it is directly required to fulfill action explicitly started by a user. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CC0673 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...
- orwin 5y ago
  Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important cookies (like a shopping cart) are usefull so GDPR don't apply. Basically, if you don't sell your user data and process it for your own services, you can recolt almost whatever you want, even PII like ip adresses
- jauco 5y ago
  Yes, any PII that you obtain for a user for the express and sole purpose of something that the user asks of you (like a delivery address or a session cookie or a name to be printed on a business card) requires no further explicit approval if you are going to use it for something else, like sending a weekly brochure after the delivery you do have to ask permission for that additional action
marcus_holmes 5y ago
I was explaining this to a co-founder and they insisted on having a banner anyway because they didn't understand the law, didn't understand the difference in cookie types, and were worried about fines. I've come to the conclusion that this should be baked into the browser rather than letting every site owner do their own thing.

neals 5y ago

Is this true? That would be great.

tester34 5y ago
I think yea, but I didn't read all cookie related stuff >Operational cookies >There are some cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular: > authentication cookies > technical cookies required by certain IT systems https://ec.europa.eu/info/cookies_en https://ec.europa.eu/info/cookies_en
szszrk 5y ago
Well, yes, although this "for technical stuff" is quite vogue and misleading. Law actually states things "strictly necessary" don't need and agreement. So your auth session doesn't need anything, but your 3rd party monitoring software does. I wish this would be easier for me. A lot of sites on my market add disgusting banners even if they don't use cookies at all, or cookies were already created :) "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." I had a glance at my local interpretation it also states that it is not necessary to consent if it is directly required to fulfill action explicitly started by a user. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CC0673 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...
orwin 5y ago
Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important cookies (like a shopping cart) are usefull so GDPR don't apply. Basically, if you don't sell your user data and process it for your own services, you can recolt almost whatever you want, even PII like ip adresses
jauco 5y ago
Yes, any PII that you obtain for a user for the express and sole purpose of something that the user asks of you (like a delivery address or a session cookie or a name to be printed on a business card) requires no further explicit approval if you are going to use it for something else, like sending a weekly brochure after the delivery you do have to ask permission for that additional action

marcus_holmes 5y ago

I was explaining this to a co-founder and they insisted on having a banner anyway because they didn't understand the law, didn't understand the difference in cookie types, and were worried about fines. I've come to the conclusion that this should be baked into the browser rather than letting every site owner do their own thing.