4 ms·

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that

by M2Ys4U 5y ago

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you write on the subject is correct. [0] Directive 2002/58/processing of personal data and the protection of privacy in the electronic communications sector - https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A...

atoav 5y ago
(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. The rest of the GDPR makes it extremely clear that the goal of the whole thing is not to mandate some specific solution but to force people who run services to allow tracking only with informed consent and to offer options that do not track. If you are not storing data on your users machines or just do so for legitimate purposes, you should not have a need to ask for a users consent and thus don't have any need a cookie banner. The issue here is, that many people running websites just don't know what they are storing and how. Just slapping a cookie banner on that bad boy and calling it a day won't work either, because you have to list the purposes of these cookies. If you don't know why your weird wordpress template loads a cookie, maybe it is time to change it (or alternatively: change your profession).
- hugoroy 5y ago
  You're quoting the 2002 adopted text's recital. This is outdated. The relevant bit about consent and cookies was added in 2009, with directive 2009/136 modifying article 5(3) of directive 2002/58. So all you're saying about legitimate interests etc. is wrong since 2011 (2009+2 years allowing for Member States implementation in national law)
  - atoav 5y ago
    Thanks for the correction
privacylawthrow 5y ago
You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no longer valid under GDPR, which is why GDPR is about cookies, and every other processing of personal data.
- speedgoose 5y ago
  You don’t need consent to use cookies. You need consent to use cookies to track.
  - privacylawthrow 5y ago
    No. You need consent to store data on an end user's machine, regardless of whether you later track that data or not, unless such storage is strictly necessary for the operation of service explicitly requested by the user.
- swores 5y ago
  By that logic the GDPR is "about" fridge magnets because any business storing personal data using letter magnets arranged on a fridge is subject to GDPR. Sure, often cookies constitute/contain personal data, but when they don't they are not regulated by GDPR.
  - bduerst 5y ago
    I mean, if you're storing user information that isn't pertinent to the business with fridge magnets on a slab of metal, and the user asks you to take them down, it's a GDPR violation if you don't remove/scramble said magnets after 30 days. Method of data storage isn't really specified, but that's why it's General Data Protection Compliance.
    - swores 5y ago
1vuio0pswjnm7 5y ago
"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
- M2Ys4U 5y ago
  That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.
  - 1vuio0pswjnm7 5y ago
    Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies." GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically. The ePrivacy Directive regulates public networks (cf. publicly accessible networks) and public electronic comminications services, e.g., e-mail, telephone, messaging. Many "tech" companies arguably fall outside that scope because their primary purpose is arguably not communications. GDPR, OTOH, is much more broad in scope and most would agree it regulates websites and "tech" companies. The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive. The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope. Until that new regulation comes into force, there are obvious reasons why the Usenix authors would cite GDPR and not the ePrivacy Directive.
    - M2Ys4U 5y ago
      > Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies." I disagree, but it's a matter of semantics. I think we can agree that the operational part of the GDPR, the part that has legal force, doesn't mention cookies. Or storing/accessing information on the the terminal equipment of a user if you want to use that definition. >GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically. But cookies can contain data that are not personal data, and those cookies require consent under the ePrivacy Directive. And absent the ePD cookies wouldn't need consent (unless that was the legal basis being relied upon under the GDPR). >The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive. No argument from me that the ePD has been (and is constantly being) ignored. And yes, the reason for the sudden increase in consent banners is because of the GDPR, for two reasons: 1) The ePD (as amended) referenced the Data Protection Directive which was replaced by the GDPR, and hence the definition of consent changed. But that still doesn't make violation of the ePD a violation of the GDPR. 2) The GDPR was very well publicised. That meant that people who had no idea what the hell all of this meant, and they first saw the requirements of the ePD at the same time as the GDPR (even though they should have been well aware of it already). >The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope. For some value of "soon". They've been promising that for six(!) years now. Hopefully the next round of trialogue (on the 31st March) will get it across the line.
tinus_hn 5y ago
It would be ineffective to have a law against cookies because everyone would just switch to localstorage or another persistent storage.
- M2Ys4U 5y ago
  Quite, that's why the ePrivacy Directive is more generic with it's language of "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user".

by M2Ys4U 5y ago

atoav 5y ago

(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. The rest of the GDPR makes it extremely clear that the goal of the whole thing is not to mandate some specific solution but to force people who run services to allow tracking only with informed consent and to offer options that do not track. If you are not storing data on your users machines or just do so for legitimate purposes, you should not have a need to ask for a users consent and thus don't have any need a cookie banner. The issue here is, that many people running websites just don't know what they are storing and how. Just slapping a cookie banner on that bad boy and calling it a day won't work either, because you have to list the purposes of these cookies. If you don't know why your weird wordpress template loads a cookie, maybe it is time to change it (or alternatively: change your profession).

hugoroy 5y ago
You're quoting the 2002 adopted text's recital. This is outdated. The relevant bit about consent and cookies was added in 2009, with directive 2009/136 modifying article 5(3) of directive 2002/58. So all you're saying about legitimate interests etc. is wrong since 2011 (2009+2 years allowing for Member States implementation in national law)
- atoav 5y ago
  Thanks for the correction

privacylawthrow 5y ago

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no longer valid under GDPR, which is why GDPR is about cookies, and every other processing of personal data.

speedgoose 5y ago
You don’t need consent to use cookies. You need consent to use cookies to track.
- privacylawthrow 5y ago
  No. You need consent to store data on an end user's machine, regardless of whether you later track that data or not, unless such storage is strictly necessary for the operation of service explicitly requested by the user.
swores 5y ago
By that logic the GDPR is "about" fridge magnets because any business storing personal data using letter magnets arranged on a fridge is subject to GDPR. Sure, often cookies constitute/contain personal data, but when they don't they are not regulated by GDPR.
- bduerst 5y ago
  I mean, if you're storing user information that isn't pertinent to the business with fridge magnets on a slab of metal, and the user asks you to take them down, it's a GDPR violation if you don't remove/scramble said magnets after 30 days. Method of data storage isn't really specified, but that's why it's General Data Protection Compliance.
  - swores 5y ago

1vuio0pswjnm7 5y ago

"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

M2Ys4U 5y ago
That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.
- 1vuio0pswjnm7 5y ago
  Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies." GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically. The ePrivacy Directive regulates public networks (cf. publicly accessible networks) and public electronic comminications services, e.g., e-mail, telephone, messaging. Many "tech" companies arguably fall outside that scope because their primary purpose is arguably not communications. GDPR, OTOH, is much more broad in scope and most would agree it regulates websites and "tech" companies. The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive. The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope. Until that new regulation comes into force, there are obvious reasons why the Usenix authors would cite GDPR and not the ePrivacy Directive.
  - M2Ys4U 5y ago
    > Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies." I disagree, but it's a matter of semantics. I think we can agree that the operational part of the GDPR, the part that has legal force, doesn't mention cookies. Or storing/accessing information on the the terminal equipment of a user if you want to use that definition. >GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically. But cookies can contain data that are not personal data, and those cookies require consent under the ePrivacy Directive. And absent the ePD cookies wouldn't need consent (unless that was the legal basis being relied upon under the GDPR). >The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive. No argument from me that the ePD has been (and is constantly being) ignored. And yes, the reason for the sudden increase in consent banners is because of the GDPR, for two reasons: 1) The ePD (as amended) referenced the Data Protection Directive which was replaced by the GDPR, and hence the definition of consent changed. But that still doesn't make violation of the ePD a violation of the GDPR. 2) The GDPR was very well publicised. That meant that people who had no idea what the hell all of this meant, and they first saw the requirements of the ePD at the same time as the GDPR (even though they should have been well aware of it already). >The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope. For some value of "soon". They've been promising that for six(!) years now. Hopefully the next round of trialogue (on the 31st March) will get it across the line.

tinus_hn 5y ago

It would be ineffective to have a law against cookies because everyone would just switch to localstorage or another persistent storage.

M2Ys4U 5y ago
Quite, that's why the ePrivacy Directive is more generic with it's language of "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user".