7 ms·

Why avoid cookies entirely? You don't need a cookie banner for cookies essential to the functioning of your site.

akie 5y ago
You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious. It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Twitter feed or Google Analytics. There are solutions for all of these things, but the standard/easy way of doing these things means your user gets a third-party cookie, which means you need the banner.
- hnarn 5y ago
  > You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. Wrong. Functional cookies are exempt.
  - nickpp 5y ago
    What are "functional cookies"? Are analytics/telemetries cookies functional? Are cookies identifying google users so they can receive targeted content but also ads "functional"? GDPR never bothered to specify. This is why GDPR is broken and sadly it broke the web.
    - hnarn 5y ago
      Have you tried finding the answer to your question online? There are clear examples of what "functional cookies" mean, even straight from the EU.
      - nickpp 5y ago
        There are many opinions online, but there is no authoritative, definitive answer. GDPR was made vague by design "to prevent future exploits". Even lawyers are arguing the details, three years after its introduction. This made GDPR in effect one of the most expensive regulations we had to implement as IT companies. It is also so incredibly punitive that everybody choose to implement it in the most conservative way possible, at the expense of the UX. Thus the cookie popups and banners.
        M2Ys4U 5y ago
        The GDPR doesn't even mention cookies. It's the ePrivacy Directive that regulates them (or, more precisely, "information stored in the terminal equipment of a subscriber"). And the ePrivacy Directive does, in fact, define what's allowed without notifying the user: "any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."
        nickpp 5y ago
        This kind of vague, high-level language is exactly why, if you reject cookies, you'll receive the same damn popup next time you visit the website until you relent and click Yes. They never tried applying their abstract concepts to the real world until we had to and the result is "The Web of Cookie Popups".
        jka 5y ago
        You have a point, but at the other end of the spectrum, writing precise legal terms can cause problems as well. If the terms refer specifically to "cookies" and "browsers", it'd be entirely possible that the advertising industry and other players would simply change their own wording to evade the law. An effective legal claim might be able to find out about and catch up with those kind of tricks; but it'd be partly a game of time, and simply by delaying legal challenges while their operations continue, the ad industry would have achieved their goals.
  - Ensorceled 5y ago
    The statement isn't "Wrong.", it's just overly strict.
  - akie 5y ago
    Of course I know that, but did you ever talk to someone who is not in technology but does have a say in determining what "we" need to do to cover "our" asses? Say, a lawyer with the responsibility that all of our websites implement all of the relevant regulations? You would think that they are up to date on what regulations you need to follow, but you'd be surprised. Many take a blanket "no risks under any circumstances" approach. These types can only be placated with the "we don't have any cookies at all" argument. And even then only barely.
tgv 5y ago
Still, the boss said: "add a banner anyway." Better safe than sorry, and everyone expects it by now.
7952 5y ago
These particular sites didn't need essential cookies and discussion about privacy/cookies was taking lots of time for no real benefit. Also, I believe philosophically in trying to reduce things like analytics and tracking.

akie 5y ago

You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious. It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Twitter feed or Google Analytics. There are solutions for all of these things, but the standard/easy way of doing these things means your user gets a third-party cookie, which means you need the banner.

hnarn 5y ago
> You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. Wrong. Functional cookies are exempt.
- nickpp 5y ago
  What are "functional cookies"? Are analytics/telemetries cookies functional? Are cookies identifying google users so they can receive targeted content but also ads "functional"? GDPR never bothered to specify. This is why GDPR is broken and sadly it broke the web.
  - hnarn 5y ago
    Have you tried finding the answer to your question online? There are clear examples of what "functional cookies" mean, even straight from the EU.
    - nickpp 5y ago
      There are many opinions online, but there is no authoritative, definitive answer. GDPR was made vague by design "to prevent future exploits". Even lawyers are arguing the details, three years after its introduction. This made GDPR in effect one of the most expensive regulations we had to implement as IT companies. It is also so incredibly punitive that everybody choose to implement it in the most conservative way possible, at the expense of the UX. Thus the cookie popups and banners.
      - M2Ys4U 5y ago
        The GDPR doesn't even mention cookies. It's the ePrivacy Directive that regulates them (or, more precisely, "information stored in the terminal equipment of a subscriber"). And the ePrivacy Directive does, in fact, define what's allowed without notifying the user: "any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."
        nickpp 5y ago
        This kind of vague, high-level language is exactly why, if you reject cookies, you'll receive the same damn popup next time you visit the website until you relent and click Yes. They never tried applying their abstract concepts to the real world until we had to and the result is "The Web of Cookie Popups".
        jka 5y ago
        You have a point, but at the other end of the spectrum, writing precise legal terms can cause problems as well. If the terms refer specifically to "cookies" and "browsers", it'd be entirely possible that the advertising industry and other players would simply change their own wording to evade the law. An effective legal claim might be able to find out about and catch up with those kind of tricks; but it'd be partly a game of time, and simply by delaying legal challenges while their operations continue, the ad industry would have achieved their goals.
- Ensorceled 5y ago
  The statement isn't "Wrong.", it's just overly strict.
- akie 5y ago
  Of course I know that, but did you ever talk to someone who is not in technology but does have a say in determining what "we" need to do to cover "our" asses? Say, a lawyer with the responsibility that all of our websites implement all of the relevant regulations? You would think that they are up to date on what regulations you need to follow, but you'd be surprised. Many take a blanket "no risks under any circumstances" approach. These types can only be placated with the "we don't have any cookies at all" argument. And even then only barely.

tgv 5y ago

Still, the boss said: "add a banner anyway." Better safe than sorry, and everyone expects it by now.

7952 5y ago

These particular sites didn't need essential cookies and discussion about privacy/cookies was taking lots of time for no real benefit. Also, I believe philosophically in trying to reduce things like analytics and tracking.