3 ms·

Yep - but to clarify, the cookies must really be NECESSARY - i.e. your site or app would be unusable without the feature they implement. A cookie that saves, f

Yep - but to clarify, the cookies must really be NECESSARY - i.e. your site or app would be unusable without the feature they implement. A cookie that saves, for instance, a preference may not be considered essential but a "Functional Cookie" that adds extra features, because your app is usable without it, and then you do need permission for it.

shafyy 5y ago
Well, what does unusable mean? If my app offers a feature and the cookie is necessary for it to work, then it's essential. For example, a cart feature in an ecommerce app. Could you shop without a cart? Sure, still I would consider this cookie essential.
- jonny_eh 5y ago
  A cart does sound essential, but I guess it's up to a judge to decide. Perhaps you should implement a cookie-less "buy now" option to avoid needing to go before a judge.
  - ipaddr 5y ago
    Like a session variable?
- g_p 5y ago
  The UK implementation of ePrivacy makes this quite clear and the regulator uses this as an example [1] in their guidance. If you are setting the cookie in direct response to a user initiated action, for functionality, that doesn't require consent. [1] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules9 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...
olau 5y ago
IANAL, but from my understanding the GDPR itself does not make this distinction. It's okay to store things to implement functionality, like login or shopping baskets. Tracking people is not okay. Now, there was a different directive preceeding the GDPR that tried to address the rampant abuse of cookies for tracking by regulating cookies directly. The intention of that directive was good, but the implementation really bad. I think this is where this distinction comes from. I don't think I've seen a case where someone who was not doing blatantly shady things with cookies got into trouble with that directive, though. It doesn't have to be obnoxious either - if you have a preferences page, you could add something like "we'll save these preferences in a cookie on your computer, okay?"

shafyy 5y ago

Well, what does unusable mean? If my app offers a feature and the cookie is necessary for it to work, then it's essential. For example, a cart feature in an ecommerce app. Could you shop without a cart? Sure, still I would consider this cookie essential.

jonny_eh 5y ago
A cart does sound essential, but I guess it's up to a judge to decide. Perhaps you should implement a cookie-less "buy now" option to avoid needing to go before a judge.
- ipaddr 5y ago
  Like a session variable?
g_p 5y ago
The UK implementation of ePrivacy makes this quite clear and the regulator uses this as an example [1] in their guidance. If you are setting the cookie in direct response to a user initiated action, for functionality, that doesn't require consent. [1] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules9 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

olau 5y ago

IANAL, but from my understanding the GDPR itself does not make this distinction. It's okay to store things to implement functionality, like login or shopping baskets. Tracking people is not okay. Now, there was a different directive preceeding the GDPR that tried to address the rampant abuse of cookies for tracking by regulating cookies directly. The intention of that directive was good, but the implementation really bad. I think this is where this distinction comes from. I don't think I've seen a case where someone who was not doing blatantly shady things with cookies got into trouble with that directive, though. It doesn't have to be obnoxious either - if you have a preferences page, you could add something like "we'll save these preferences in a cookie on your computer, okay?"