Maybe they're not tracking any personal data? The ePrivacy Directive ("cookies law") is years older than GDPR and only requires notification not consent. Sites

Maybe they're not tracking any personal data? The ePrivacy Directive ("cookies law") is years older than GDPR and only requires notification not consent. Sites which choose to store zero PD (which includes e.g. not logging IP addresses) are GDPR compliant automatically, but still need to notify about cookies if using them. edit: though, having looked at their privacy policy it seems they do use PD... so yeah, not good (unless I'm misunderstanding their tracking policy which I don't think I am) https://www.ieee.org/security-privacy.html https://www.ieee.org/security-privacy.html