3 ms·

You and the parent are conflating GDPR with the "ePrivacy Directive" (cookie law). GDPR doesn't say much about cookies. What GDPR says is that you have to have

You and the parent are conflating GDPR with the "ePrivacy Directive" (cookie law). GDPR doesn't say much about cookies. What GDPR says is that you have to have a legal basis for processing user data. For example, a DPA just ruled that Facebook doesn't have a "legitimate interest" when using the user profile for ads targeting, so they'll be forced to ask for opt-in consent without the ability to deny service to those that refuse. A legitimate interest is for things the customer expects as part of the service, e.g. an address is needed for home delivery, or maybe data needed for security (IP logging). https://thisisunpacked.substack.com/p/the-eu-war-on-behavioral-advertising https://thisisunpacked.substack.com/p/the-eu-war-on-behavior... The cookie banners are needed when websites are fingerprinting users. The website may have a legitimate interest for doing analytics, but the user still needs to be informed that they are fingerprinted. NOTE: here, too, you don't need cookie banners if it's functionality that the user expects, like a session or a shopping cart cookie. At the risk of repeating myself: websites need cookie banners or GDPR consent dialogs mostly when doing shit that violates people's privacy. I've read a lot of complaints against GDPR on HN and elsewhere and I feel that it misses the forest from the trees: those banners and dialogs expose just how widespread the practice of violating people's privacy is. And I fear that a lot of the backlash coming from Silicon Valley has been from people connected to the ads industry.

jefftk 3y ago
> NOTE: here, too, you don't need cookie banners if it's functionality that the user expects, like a session or a shopping cart cookie. As I point out every time this comes up, under ePrivacy the burden the site has to meet is not "expects" but "strictly necessary to satisfy a user request". And the way most sites implement shopping carts, where items will still be in your cart if you close your browser and come back the next day, isn't ok: a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant's website in the following minutes. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... (2.3) Maintaining a shopping cart across days isn't "strictly necessary" and so requires explicit consent. (More: https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners)
- bad_user 3y ago
  IANAL, but as a layman, I don't think I agree with your article. But thanks for the links. I don't think the difference between hours and days is relevant, unless the law says that there's a difference. Setting user preferences, such as the language, is a matter of accessibility. I'd be hard-pressed to think of a better sample of “strictly required”. Setting user preferences, such as a “dark mode” toggle, wouldn't be any different from setting the browser or operating system's dark mode preference, a bit that web pages can always read. It's important to remember that ePrivacy isn't strictly about cookies, but about all client-side data that gets sent to the server. For example, in case you're doing analytics, fingerprinting via any other means except for cookies (e.g., user agent, HTTP referrer, IP, etc.) still counts under ePrivacy. As such, you can fingerprint users via “window.matchMedia('(prefers-color-scheme: dark)')”, and if you do that, then yes, you need a cookie banner. But not for doing what the user agent asked for. For analytics, indeed, you need a cookie banner. And while it's a concern of service providers to improve their service that I understand, it's not something that the user expects. And my personal problem is that the entire web ended up using Google Analytics. Such data ends up being shared with third parties, which is why it's good that it is opt-in. I do agree that businesses should consult lawyers (＾＾)ｂ
  - jefftk 3y ago
    Remembering user preferences are very different; I didn't bring them up and don't disagree there. My claim is that many things users might expect to be retained are not automatically ok to retain, and that shopping carts as typically implemented are one of these.

jefftk 3y ago

> NOTE: here, too, you don't need cookie banners if it's functionality that the user expects, like a session or a shopping cart cookie. As I point out every time this comes up, under ePrivacy the burden the site has to meet is not "expects" but "strictly necessary to satisfy a user request". And the way most sites implement shopping carts, where items will still be in your cart if you close your browser and come back the next day, isn't ok: a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant's website in the following minutes. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... (2.3) Maintaining a shopping cart across days isn't "strictly necessary" and so requires explicit consent. (More: https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners)

bad_user 3y ago
IANAL, but as a layman, I don't think I agree with your article. But thanks for the links. I don't think the difference between hours and days is relevant, unless the law says that there's a difference. Setting user preferences, such as the language, is a matter of accessibility. I'd be hard-pressed to think of a better sample of “strictly required”. Setting user preferences, such as a “dark mode” toggle, wouldn't be any different from setting the browser or operating system's dark mode preference, a bit that web pages can always read. It's important to remember that ePrivacy isn't strictly about cookies, but about all client-side data that gets sent to the server. For example, in case you're doing analytics, fingerprinting via any other means except for cookies (e.g., user agent, HTTP referrer, IP, etc.) still counts under ePrivacy. As such, you can fingerprint users via “window.matchMedia('(prefers-color-scheme: dark)')”, and if you do that, then yes, you need a cookie banner. But not for doing what the user agent asked for. For analytics, indeed, you need a cookie banner. And while it's a concern of service providers to improve their service that I understand, it's not something that the user expects. And my personal problem is that the entire web ended up using Google Analytics. Such data ends up being shared with third parties, which is why it's good that it is opt-in. I do agree that businesses should consult lawyers (＾＾)ｂ
- jefftk 3y ago
  Remembering user preferences are very different; I didn't bring them up and don't disagree there. My claim is that many things users might expect to be retained are not automatically ok to retain, and that shopping carts as typically implemented are one of these.