2 ms·
Device ID cookies for analytics like error reporting or a non-essential function like feature gates rollout are not strictly necessary for the user to complete
by jitl 3y ago
Device ID cookies for analytics like error reporting or a non-essential function like feature gates rollout are not strictly necessary for the user to complete their goal, and so need consent under the UK’s version of the GDPR. You also need user consent if you’re re-using an essential cookie like a session token for non-essential purposes like analytics or feature delivery.
See https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules7 https://ico.org.uk/for-organisations/direct-marketing-and-pr... section titled “What is the ‘strictly necessary’ exemption”
To my knowledge, the UK’s cookie law is the most restrictive one and drives a lot of the recent increase in these consent banners
- Fire-Dragon-DoL 3y agoAll of this has to be proven in court, which is really complex, but rolling out features seems definitely a legitimate interest of your business, especially if it can break your software. It sounds like the same reason you are allowed to log the user IP, to prevent malicious attackers
- jitl 3y agoIt seems like most websites, including the one I work on, disagree with your assessment ¯\_(ツ)_/¯
- Fire-Dragon-DoL 3y agoNo, all websites show a banner on purpose to ensure users clicks on "allow all", or ensure the user gets the most annoyed when clicking on reject all by asking it again, or when click on "reject all" consider ADVERTISING as legitimate interest (apparently a loophole has been found). Given that, I doubt this is certain in any way. Unfortunately without a court (not even just a lawyer), it's really hard to provide a definitive answer