3 ms·

I know the principles, but it's not that easy. AFAICU (I'm not a lawyer), if we only considered the cookie law, it was perfectly ok not to give access to my we

I know the principles, but it's not that easy. AFAICU (I'm not a lawyer), if we only considered the cookie law, it was perfectly ok not to give access to my website until the user had clicked "ok" on my terms and accepted my cookies. Nothing forced the website owner to offer a "partial acceptance of terms". The user just had to be informed. Then GDPR happened. Now the marketing consent must be given freely, so "marketing cookies" need to be excluded. I use very few cookies on my website, but I employ Google Analytics (with some privacy options set) and Disqus (which has changed ownership some years ago). Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those?

scrollaway 5y ago
> Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those? Even if they are served by third parties, you are the one who is responsible for those cookies. GA is definitely non-essential, disqus probably too. So if you want to be by the book, you need to ask the user for consent: If they consent, you can enable GA and Disqus. If they reject, you should disable those. You can also split up consent for disqus and GA. Now the "cookie banner" pattern frankly sucks egg. You don't have to go that route specifically. What you could do instead as a more user-friendly approach, as far as the comments go, is a "load comments" button which, when you click it, tells the user "Our comments are hosted externally. In order to load them, we need to load third party scripts and cookies from disqus.com. See Disqus privacy policy here <link>. [Accept] [Reject]" -- Once they click that, you're good to always load the comments by default, no more button/pop-up.
- alanfranz 5y ago
  This can get very complex very quickly for a personal blog, though. I can remove GA at any time, and I'll probably remove it since I rarely look at my analytics, but Disqus is essential for commenting, which is integral to blogging IMHO. The problem with the cookie law and the GDPR is that they adopt greenfield approach to an existing environment, without implementation examples. BTW, as far as I know, the GDPR doesn't apply to me as "a natural person in the course of a purely personal or household activity", while the cookie law DOES apply. But the scope of such statement if highly debated and, of course, Google and Disqus are not exempt from the GDPR. So? I feel that the GDPR is a good law. But it simply ignoring the status quo from an implementation perspective won't yield the results the lawmaker hoped for.

scrollaway 5y ago

> Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those? Even if they are served by third parties, you are the one who is responsible for those cookies. GA is definitely non-essential, disqus probably too. So if you want to be by the book, you need to ask the user for consent: If they consent, you can enable GA and Disqus. If they reject, you should disable those. You can also split up consent for disqus and GA. Now the "cookie banner" pattern frankly sucks egg. You don't have to go that route specifically. What you could do instead as a more user-friendly approach, as far as the comments go, is a "load comments" button which, when you click it, tells the user "Our comments are hosted externally. In order to load them, we need to load third party scripts and cookies from disqus.com. See Disqus privacy policy here <link>. [Accept] [Reject]" -- Once they click that, you're good to always load the comments by default, no more button/pop-up.

alanfranz 5y ago
This can get very complex very quickly for a personal blog, though. I can remove GA at any time, and I'll probably remove it since I rarely look at my analytics, but Disqus is essential for commenting, which is integral to blogging IMHO. The problem with the cookie law and the GDPR is that they adopt greenfield approach to an existing environment, without implementation examples. BTW, as far as I know, the GDPR doesn't apply to me as "a natural person in the course of a purely personal or household activity", while the cookie law DOES apply. But the scope of such statement if highly debated and, of course, Google and Disqus are not exempt from the GDPR. So? I feel that the GDPR is a good law. But it simply ignoring the status quo from an implementation perspective won't yield the results the lawmaker hoped for.