6 ms·
That's not correct: the ePrivacy directive doesn't distinguish between first and third party cookies but instead about whether the cookies are "strictly necessa
by jefftk 4y ago
That's not correct: the ePrivacy directive doesn't distinguish between first and third party cookies but instead about whether the cookies are "strictly necessary for the delivery of a service requested by the user".
- hnbad 4y agoYes. And login state or preferences are perfectly valid "functional uses" that don't require consent (but need to be spelled out in the privacy policy by most interpretations of the law). The difference between first and third party cookies/embeds is only relevant when the third party may be collecting data (e.g. keeping access logs). This covers things like Google Fonts, Google Maps and social media embeds all of which should be opt-in and have fallback options (like an external link to the otherwise embedded post or map).
- dmitriid 4y agoGDPR supersedes ePrivacy.
- morelisp 4y agoNo, the in-proposal ePrivacy Regulation supersedes the in-effect ePrivacy Directive. GDPR overlaps (or rather, mandates a specific implementation of) only a small portion of the ePD. Most of the ePD is still open for implementation and most of the GDPR does not overlap with it.
- jefftk 4y agoThat's not correct. Both are in effect simultaneously, and they each restrict different behaviors. Very roughly: ePrivacy restricts sites' use of client-side storage, the GDPR restricts their use of personal information.