Yes you can store a session cookie without a pop-up, as long as it's essential. For example, a login cookie is fine. Even if you were adding a tracking adverti

Yes you can store a session cookie without a pop-up, as long as it's essential. For example, a login cookie is fine. Even if you were adding a tracking advertising cookie, someone would have to complain, your national data agency would have to care enough to investigate, and then all they'd do is ask you to rectify it (no fine, as you're too small fry). If you didn't rectify it, that's when things would start to get into litigious/fine territory. Strictly speaking I think you should have some mention of your session cookie on a privacy page explaining its usage for GDPR, but you don't need a consent pop-up because it's not a tracking cookie you share with third parties. But it's been a while since I dealt with GDPR and can't remember the exact requirement now. But again no-ones going to care enough to make you until you start making money. If your business is a UK corporation, and you're storing PII that's not just for accounts, billing, etc. you would need to register with the ICO and pay £40 per year. It's probably similar for other EU countries. The ICO are currently spamming every business in the UK with threatening letters claiming everyone owes them £40 per year because they're massively underfunded and that's the only way they can make money, basically quadrupling the cost of running a business in the UK (used to be a tiny £15 to companies house per year, now £55 with the ICO fee).