6 ms·

> You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking. That is a common misunde

• raverbashing 5y ago
  Yeah, item 25 is interesting, but the way I read this it's more about the informative links instead of the click-to-allow ones > strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". Sounds to me then that login/customizations are allowed
• snek_case 5y ago
  I've been wondering about that. I have a simple web app and I'd like to gather some basic statistics about what users do, which pages they visit... Not to spy on people, not to share with anyone else, just to have some insight on how to make the app better. The app is just a toy program people use for fun, you couldn't possibly argue that any stats I'd be collecting could be used maliciously. It seems to be difficult to do that while respecting the GDPR and without some annoying pop-up though?
  • number6 5y ago
    Do you really need cookies for this or could you also use your server logs for this? Per default you could not gather statistics but ask inside you app if people are willing to participate in making the app better and if they would agree to accept some cookies for this reason.
    • snek_case 5y ago
      I don't need cookies for this. However, AFAIK the GDPR doesn't just apply to cookies, it applies to any data retention, or at least anything that could be tied to an IP address or a certain user. Maybe the key is to have stats that are purely anonymous, eg, how many people visited this page.
      • number6 5y ago
        Right, I focused on cookies here. Yes you could just cut the IP out of the logs and check the visited sites and requested resources.
      • jefftk 5y ago
        If you're using server logs, without any cookies or other client-side storage, then the ePrivacy Directive is not relevant and you're thinking about the GDPR. Unlike ePrivacy, the GDPR is specifically concerned with personal data, so if you are careful in how you set up your logs you can generally still collect good analytics on how people use your site without accidentally collecting data on how a specific person uses your site. (still not a lawyer)
  • jefftk 5y ago
    Cookie banners predate the GDPR: they were initially for the (much older) ePrivacy Directive, though many sites now have combination consent gathering flows for ePrivacy+GFPR. For your specific question, I think the Planet49 ruling gets pretty close. "It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual's device." [1] (still not a lawyer) [1] https://www.twobirds.com/en/news/articles/2019/global/planet49-cjeu-rules-on-cookie-consent https://www.twobirds.com/en/news/articles/2019/global/planet...
  • namdnay 5y ago
    Just do it server side, with a unique session token.
    • ErikCorry 5y ago
      How do you assign individual web requests to a session without cookies?
      • namdnay 5y ago
        generate a random ID in js when your page starts, set it in the context and send it as a header on every request
      • notreallyserio 5y ago
        Add a session id to the URL and all generated links, I'd guess. Still probably not any more legit than a cookie, though.
        • jefftk 5y ago
          I wouldn't be surprised if that fell under "similar devices", just like localStorage.
    • lixtra 5y ago
      While might not be caught easily, you‘r still not compliant with GDPR by doing it all on the server without consent.
      • namdnay 5y ago
        GDPR only applies to PII. If you're just collecting anonymous session tokens you're fine (it's what comes "out of the box" if you host your webapp on AWS for example, you'll see an AWS correlator ID in the request headers)
  • NavinF 5y ago
    Technical answer: You can use Differential Privacy[1] to collect such data (“what percentage of users used this feature?”, “What is the distribution of time between visits?”, etc) without collecting any data about individuals. Some projects already do this and there are open source libraries that do the math for you. However, I don’t think the regulations have an explicit safe harbor along the lines of “You’re fine as long as the math checks out”. Perhaps if it did, we wouldn’t be in such a mess. (A passive observer that sees a JSON POST wouldn’t know that you’re using differential privacy. It would look like typical telemetry. They’d have to read your code or look at multiple samples and notice that the data looks random) https://en.m.wikipedia.org/wiki/Differential_privacy https://en.m.wikipedia.org/wiki/Differential_privacy
  • tlarkworthy 5y ago
    plausible analytics claims to not need consent as it does not do user level tracking or issue clienside state. https://plausible.io/ https://plausible.io/
  • gpm 5y ago
    Do you really need to know which pages a particular user visits, or just which pages are visited frequently. The latter is easily gathered from web server logs, the former sounds like a case of "I want to do this bad thing (spying on users) for good reasons", and the law only cares that it's a bad thing, not about your reasons (or arguably it does care slightly about your reasons, but not in enough detail to accommodate your use case). Laws being rather blunt tools and reasons being rather hard to divine.
    • jefftk 5y ago
      You might want to know, in aggregate, which paths users take through your site so you can make it better. This requires cookies, and the cookies are not, in my reading, essential for the site to function.
      • gpm 5y ago
        Yes... Agreed on both points. You can get a bit of that via referrers, but not as much as you would like.
• rozab 5y ago
  Surely if someone has instructed the website to remember a setting, then that cookie was explicitly requested by the user?
  • jefftk 5y ago
    Storing something in response to an explicit user request seems fine without additional consent, though you still need to explain to users how the cookies are used to fulfill their request. [1] On the other hand, there are many things that sites do that are not fully explicit. For example, shopping sites often show you items you have recently viewed to facilitate comparisons, or a news site showing ads might want to make sure they don't show you the same one over and over. That doesn't sound to me like it is strictly necessary for the functioning of the site? [1] "users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using"
    • notreallyserio 5y ago
      Couldn't sites wait to ask for cookie permission until the actually user tries to do something that may benefit from a cookie? Like put text and a link with an explanation next to buttons to change the theme or regions which may contain recently viewed items.
      • q3k 5y ago
        Yes.
      • DangitBobby 5y ago
        Preferably this would use a browser cookie setting. I know you use cookies to store my settings, I don't need you to ask. Please stop asking.
• jamil7 5y ago
  I was under the impression that for something like a session token stored in a first-party cookie you don't need consent. The second paragraph refers to both GDPR and ePrivacy directive. > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. [1] > Receive users’ consent before you use any cookies except strictly necessary cookies. [1] [1] https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
  • jefftk 5y ago
    It depends on what you're doing with the session cookie. If it is just for holding shopping cart items or tracking whether you are logged in, I agree with you. But there are many first-party things sites want to do which are probably not "strictly necessary".
• q3k 5y ago
  It’s not that high. Here’s an official opinion on some usecases that meet the bar and some that don’t: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... Generally, it matches my expectations. Shopping carts, sessions, and even most user preferences are fine and don’t need a banner. Worst case a small “uses cookies” text next to a language change button is enough.
  • jefftk 5y ago
    It is still very strict. For example, here is what the document you link has to say about cookie lifetimes for shopping carts: "A cookie that is exempted from consent should have a lifespan that is in direct relation to the purpose it is used for, and must be set to expire once it is not needed, taking into account the reasonable expectations of the average user or subscriber. This suggests that cookies that match CRITERION A and B will likely be cookies that are set to expire when the browser session ends or even earlier. However, this is not always the case. For example, in the shopping basket scenario presented in the following section, a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant’s website in the following minutes."
    • Freak_NL 5y ago
      So? That's totally what I'd expect from a shopping cart cookie. I don't expect something I put in a cart to be there the next day (I will have bought it somewhere else). I was using the website for a Dutch big box hardware store (Gamma) today, and it had a door stopper I was looking to purchase half a year ago in my shopping cart. I never finished that transaction. That kind of retention is just pointless.
      • jefftk 5y ago
        While I do agree keeping items in the cart for a year is not what users expect, if someone puts something in their cart, closes the browser, and then comes back the next day, I think most e-commerce sites would still list the item. And I think that's generally something users want.