4 ms·

Last I read the law, any cookie used for the functioning of the site, and not for the tracking of the user, is perfectly fine without a cookie banner.

majewsky 3y ago
I was going to agree with you, but in researching this, it does seem that GP is right. This is the source that I found: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ As far as I can see, this is a resource funded by the EU, so not quite authoritative, but good enough IMO. They say: > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. [...] This sounds like what you're saying, but this verbiage is based on a classification of cookies further above where a distinction is made: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. [...] > > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for [...] So "strictly necessary" really only means "the site breaks without this", e.g. a session cookie set by a login page or the shopping cart example that the quoted article explicitly calls out, too. Presentational settings like display density, font size, dark/light mode and such seem to require consent.
- askonomm 3y ago
  Ah, so the truth was more specific than I thought. Consider me educated!
zamadatix 3y ago
https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... 3.6 UI customization cookies: "These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted under CRITERION B. The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case." In particular, criterion A "functioning of the site" is a lot more narrow than your interpretation. It sounds like "oh, they need this to use the site's functions" but it really describes is functionality more like "you can't use the site at all without setting this cookie because you couldn't authenticate" and criterion B "for service explicitly requested" has more limitations (like lasting beyond session).

majewsky 3y ago

I was going to agree with you, but in researching this, it does seem that GP is right. This is the source that I found: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ As far as I can see, this is a resource funded by the EU, so not quite authoritative, but good enough IMO. They say: > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. [...] This sounds like what you're saying, but this verbiage is based on a classification of cookies further above where a distinction is made: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. [...] > > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for [...] So "strictly necessary" really only means "the site breaks without this", e.g. a session cookie set by a login page or the shopping cart example that the quoted article explicitly calls out, too. Presentational settings like display density, font size, dark/light mode and such seem to require consent.

askonomm 3y ago
Ah, so the truth was more specific than I thought. Consider me educated!

zamadatix 3y ago

https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... 3.6 UI customization cookies: "These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted under CRITERION B. The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case." In particular, criterion A "functioning of the site" is a lot more narrow than your interpretation. It sounds like "oh, they need this to use the site's functions" but it really describes is functionality more like "you can't use the site at all without setting this cookie because you couldn't authenticate" and criterion B "for service explicitly requested" has more limitations (like lasting beyond session).