> A 1st party cookie for tracking a session that stays on the site doesn't need consent/popups. All cookie laws, including GDPR and CCPA, allow essential first-

> A 1st party cookie for tracking a session that stays on the site doesn't need consent/popups. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions I'd love to hear some legal or DPA opinion on this. From what I know, per the ePrivacy Directive in the version from 2009, any access or storage to information on the end user's device needs consent unless that access/storage is strictly necessary for a service explicitly requested by the user. This is known as the “cookie law”, but is not technology-specific and will also apply to equivalent client-side approaches such as LocalStorage, tracking IDs in URLs, or fingerprinting. The consent requirement is also independent of the question of whether the stored information qualifies as personal data. The GDPR didn't change anything with these rules. It only changed the definition of consent, invalidating “implied consent” approaches like “by continuing to use this site, you consent to …”. Consent means opt-in. Consent must be easy to decline and withdraw, and users must understand what precisely they are consenting to. This has led to a decrease in the percentage of people who consent to the storage of analytics IDs. So the question is whether we can be considered as a strictly necessary for a service