5 ms·

I went to their website in incognito mode. https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analyti

I went to their website in incognito mode. https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en Before accepting any cookies I got a _pk_id cookie expiring in 13 months. They are clear this is what will happen. Just check it for yourself before you listen to the lies / blather you read here. The EU's own websites track you on first landing. Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it. The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.

Nextgrid 5y ago
> until you gave consent or denied it [emphasis mine] That seems fine. Not the greatest UX but as long as you're able to decline it should be compliant.
- whoknowswhat11 5y ago
  I'm not giving a legal opinion, but some say that "Consent must be freely given, specific, informed and unambiguous." So a question remains, if you give someone the option to decline to be tracked, is that enough? Or do you need actual consent? The EU website is doing the tracking with option not to be. Other experts say you really should have consent first before doing any tracking. Anyways, not giving my opinion on which is right, just that there are different views, and even EU does it in ways I think that folks here do not understand. The one thing, the EU sites are extremely CLEAR about things, I do like that.
  - aembleton 5y ago
    You need actual consent in order to store personal data. I don't think the UK GDPR differs yet from the EU one, so the ICO guide might still be useful. I find it much clearer than guidance I can find from the EU: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
aembleton 5y ago
Strange, I get different cookies to you. I get one session cookie called 'has_js' and one called 'cck1' that expires in six months. I'm sure GDPR allows for the setting of cookies, just not the storage of personal data without explicit consent.

Nextgrid 5y ago

> until you gave consent or denied it [emphasis mine] That seems fine. Not the greatest UX but as long as you're able to decline it should be compliant.

whoknowswhat11 5y ago
I'm not giving a legal opinion, but some say that "Consent must be freely given, specific, informed and unambiguous." So a question remains, if you give someone the option to decline to be tracked, is that enough? Or do you need actual consent? The EU website is doing the tracking with option not to be. Other experts say you really should have consent first before doing any tracking. Anyways, not giving my opinion on which is right, just that there are different views, and even EU does it in ways I think that folks here do not understand. The one thing, the EU sites are extremely CLEAR about things, I do like that.
- aembleton 5y ago
  You need actual consent in order to store personal data. I don't think the UK GDPR differs yet from the EU one, so the ICO guide might still be useful. I find it much clearer than guidance I can find from the EU: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

aembleton 5y ago

Strange, I get different cookies to you. I get one session cookie called 'has_js' and one called 'cck1' that expires in six months. I'm sure GDPR allows for the setting of cookies, just not the storage of personal data without explicit consent.