3 ms·

Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Go

Because the law is unclear and lots of sites are afraid to accidentally violate it. If you search "do you need a cookies banner to operate in the EU" online, Google's suggested answer is "If your site has EU or UK visitors, you require a cookie banner to comply with GDPR," which you're saying isn't exactly true.

JohnFen 3y ago
I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.
- hot_gril 3y ago
  If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in doubt, consult an attorney that works with these issues. If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.
  - cccbbbaaa 3y ago
    Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also applies to local storage or any other way to store and retrieve data on a user's device. The issue is not that the law is unclear, it's people that can't help but speculate on its content even though they never read it. Google is full of links to this, and HN is bad in this regard. And to be honest, this is not exclusive to GDPR. I've found Stackexchange law and /r/gdpr to be okay-ish. Otherwise, there is a guide on the commission's website, there is gdpr.eu, there is the commented version of GDPR on gdprhub.eu: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... https://gdpr.eu/ https://gdpr.eu/ https://gdprhub.eu/index.php?title=Article_1_GDPR https://gdprhub.eu/index.php?title=Article_1_GDPR You can find a lot of advice on various DPAs website (ICO, and even the CNIL publishes stuff in english sometimes). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr...
    - TheRealPomax 3y ago
      Of course the problem with "strictly necessary" is that it doesn't mean what the words mean. Almost nothing is strictly necessary to just serve content when a URL is accessed, so it has been made quite intentionally super murky. Beyond a session id, they're not even strictly necessary for serving content to logged in users, so there needs to be a place for people to agree and/or manager their cookie settings as part of their user settings, but user preferences, localStorage, etc. are still not strictly necessary to serve login-locked content on a URL.
      - cccbbbaaa 3y ago
        With all due respect, this is the kind of speculation I was complaining about earlier. >Almost nothing is strictly necessary to just serve content when a URL is accessed That's not what the law says. > 3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. Emphasis mine. It's not to just serve content, but to provide a service requested by the user. This should clear up the confusion. Full text here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, I provided a link from the ICO that explicitly says it's OK for user IDs, user preferences, etc. The CNIL agrees: https://www.cnil.fr/sites/cnil/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf https://www.cnil.fr/sites/cnil/files/atoms/files/lignes_dire... See point 49. The EDPB agrees: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
        3y ago
  - JohnFen 3y ago
    > If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear. My whole point is that you don't need to consult a lawyer for a basic website. You need to do that if what you want to do is near the edge of the law. If you're using cookies for functional website reasons, you don't need to present a banner. That's very clear.

JohnFen 3y ago

I don't think the law is unclear at all on this point. If your site wants to ride the fine line of what is allowed, you can get into a gray area. But unless you're trying to push the boundary, there isn't any mystery. > Google's suggested answer Do not trust Google's suggested answers for anything that matters. If you're really in doubt, consult an attorney that works with these issues.

hot_gril 3y ago
If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in doubt, consult an attorney that works with these issues. If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear.
- cccbbbaaa 3y ago
  Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also applies to local storage or any other way to store and retrieve data on a user's device. The issue is not that the law is unclear, it's people that can't help but speculate on its content even though they never read it. Google is full of links to this, and HN is bad in this regard. And to be honest, this is not exclusive to GDPR. I've found Stackexchange law and /r/gdpr to be okay-ish. Otherwise, there is a guide on the commission's website, there is gdpr.eu, there is the commented version of GDPR on gdprhub.eu: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... https://gdpr.eu/ https://gdpr.eu/ https://gdprhub.eu/index.php?title=Article_1_GDPR https://gdprhub.eu/index.php?title=Article_1_GDPR You can find a lot of advice on various DPAs website (ICO, and even the CNIL publishes stuff in english sometimes). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/direct-marketing-and-pr...
  - TheRealPomax 3y ago
    Of course the problem with "strictly necessary" is that it doesn't mean what the words mean. Almost nothing is strictly necessary to just serve content when a URL is accessed, so it has been made quite intentionally super murky. Beyond a session id, they're not even strictly necessary for serving content to logged in users, so there needs to be a place for people to agree and/or manager their cookie settings as part of their user settings, but user preferences, localStorage, etc. are still not strictly necessary to serve login-locked content on a URL.
    - cccbbbaaa 3y ago
      With all due respect, this is the kind of speculation I was complaining about earlier. >Almost nothing is strictly necessary to just serve content when a URL is accessed That's not what the law says. > 3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. Emphasis mine. It's not to just serve content, but to provide a service requested by the user. This should clear up the confusion. Full text here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, I provided a link from the ICO that explicitly says it's OK for user IDs, user preferences, etc. The CNIL agrees: https://www.cnil.fr/sites/cnil/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf https://www.cnil.fr/sites/cnil/files/atoms/files/lignes_dire... See point 49. The EDPB agrees: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
      - 3y ago
- JohnFen 3y ago
  > If I have to consult a lawyer just to run a basic website without cookie banners, that means the law is unclear. My whole point is that you don't need to consult a lawyer for a basic website. You need to do that if what you want to do is near the edge of the law. If you're using cookies for functional website reasons, you don't need to present a banner. That's very clear.