4 ms·

I've seen websites that use no cookies at all put up the banner. (Just in case.)

• mananaysiempre 4y ago
  (Not a lawyer.) The GDPR is not about cookies, the freely-given consent requirement applies just the same if they’re tracking you in other ways (perhaps submitting a fingerprint via XHR, or even server-side—arguably just storing IPs in an access log counts[1]). The recorded data doesn’t have to be actively used to identify you, only usable for that purpose in principle. The earlier 2002 “ePrivacy Directive”[2], which came to be known as “cookie law”, does mention cookies in the motivational part, though the actual text just refers to storing stuff client-side whatever the means. Storage strictly required for the website to function is specifically exempted. Unlike what the GDPR would say later, the preamble said sites would be able to tell users to GTFO if they refuse the cookies. [1] https://curia.europa.eu/juris/document/document_print.jsf?mode=DOC&pageIndex=0&docid=184668&part=1&doclang=EN&text=&dir=&occ=first&cid=35216 https://curia.europa.eu/juris/document/document_print.jsf?mo... (ruling), https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%91582/14_-_Patrick_Breyer https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%91582/14_-... (unofficial explanation) [2] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX..., recital 25 and article 5(3).