4 ms·

No. Cookie banners cover any use of client size storage. That includes things like shopping carts and personalization (purely first party), analytics ("first pa

by jefftk 3y ago

No. Cookie banners cover any use of client size storage. That includes things like shopping carts and personalization (purely first party), analytics ("first party"), and ads (usually "third party"). Part of what's confusing here is that "first party" and "third party" are being used in a technical sense to mean which domain the cookies are set on. If on an example.com page JS from example.net causes a cookie to be set on example.com that's "first party", while if the cookie is set on any other domain that's "third party".

Nextgrid 3y ago
Shopping carts (and other purely-functional, essential purposes) do not require a consent popup.
- jefftk 3y ago
  Shopping carts require cookies if they go beyond what is "strictly necessary to provide a service explicitly requested by the user". This is quite a high bar, and most shopping cart implementations do not meet it. For example, if you put something in your cart on Monday but then don't purchase, it is not strictly necessary that it still be in your cart should you return on Tuesday to complete your purchase, so holding it overnight requires consent. I wrote more about this in https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners and the relevant guidelines are section 2.3 of https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
  - Nextgrid 3y ago
    Thanks for the explanation - you learn something new every day. You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?
    - jefftk 3y ago
      Yes, if you only need consent for the cart then matching the notification to the action is nice.
      - tzs 3y ago
        I don't see how this: >> You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”? would count as consent under EU standards. I thought consent had to be indicated unambiguously. Clicking an "add to cart" button only unambiguously indicates that the user wants to add the item to their card, not that they are consenting to (or have even noticed) some footnote below the button.
  - viraptor 3y ago
    I think you're taking the interpretation quite far in your post. I've seen legal department giving approval for a much less strict interpretation - basically on the level of "is this cookie realistically useful for this specific purpose". It would be useful to get some real cases that answer those questions, because on one extreme, "strictly" you don't need any local browser storage at all - the product page can contain a form to print out for a mail order and you can track your cart on paper.
    - Nextgrid 3y ago
      Realistically speaking, nobody is getting in trouble over this, so feel free to ignore and set your shopping carts to 30 days or a year or whatever. There are much bigger breaches of the GDPR/ePrivacy out there and entire businesses built upon them and they keep operating in total impunity.
  - hunter2_ 3y ago
    Why would it matter if you take 1 minute or 1 day? Either way, the baseline expectation of functionality is for state to persist from one page request to the next page request, no matter how short or long that interval happens to be, and some kind of local storage (typically a cookie) facilitates that for both cases equally. Is it just to replicate the experience of that for which an online cart is a metaphor: with a physical shopping cart, a store employee will empty it out if it's abandoned overnight unless you explicitly ask them to hold it?
    - kyriakos 3y ago
      It matters because a browser may be shared between different users and a persistent shopping cart is a leak of private information.
      - hunter2_ 3y ago
        Interesting. I feel like if you decide to share your OS session (and therefore your browser data which goes well beyond that cart: things like the passwords it offered to save!) all hope is already lost when it comes to isolation between users.

by jefftk 3y ago

Nextgrid 3y ago

Shopping carts (and other purely-functional, essential purposes) do not require a consent popup.

jefftk 3y ago
Shopping carts require cookies if they go beyond what is "strictly necessary to provide a service explicitly requested by the user". This is quite a high bar, and most shopping cart implementations do not meet it. For example, if you put something in your cart on Monday but then don't purchase, it is not strictly necessary that it still be in your cart should you return on Tuesday to complete your purchase, so holding it overnight requires consent. I wrote more about this in https://www.jefftk.com/p/why-so-many-cookie-banners https://www.jefftk.com/p/why-so-many-cookie-banners and the relevant guidelines are section 2.3 of https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio...
- Nextgrid 3y ago
  Thanks for the explanation - you learn something new every day. You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?
  - jefftk 3y ago
    Yes, if you only need consent for the cart then matching the notification to the action is nice.
    - tzs 3y ago
      I don't see how this: >> You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”? would count as consent under EU standards. I thought consent had to be indicated unambiguously. Clicking an "add to cart" button only unambiguously indicates that the user wants to add the item to their card, not that they are consenting to (or have even noticed) some footnote below the button.
- viraptor 3y ago
  I think you're taking the interpretation quite far in your post. I've seen legal department giving approval for a much less strict interpretation - basically on the level of "is this cookie realistically useful for this specific purpose". It would be useful to get some real cases that answer those questions, because on one extreme, "strictly" you don't need any local browser storage at all - the product page can contain a form to print out for a mail order and you can track your cart on paper.
  - Nextgrid 3y ago
    Realistically speaking, nobody is getting in trouble over this, so feel free to ignore and set your shopping carts to 30 days or a year or whatever. There are much bigger breaches of the GDPR/ePrivacy out there and entire businesses built upon them and they keep operating in total impunity.
- hunter2_ 3y ago
  Why would it matter if you take 1 minute or 1 day? Either way, the baseline expectation of functionality is for state to persist from one page request to the next page request, no matter how short or long that interval happens to be, and some kind of local storage (typically a cookie) facilitates that for both cases equally. Is it just to replicate the experience of that for which an online cart is a metaphor: with a physical shopping cart, a store employee will empty it out if it's abandoned overnight unless you explicitly ask them to hold it?
  - kyriakos 3y ago
    It matters because a browser may be shared between different users and a persistent shopping cart is a leak of private information.
    - hunter2_ 3y ago
      Interesting. I feel like if you decide to share your OS session (and therefore your browser data which goes well beyond that cart: things like the passwords it offered to save!) all hope is already lost when it comes to isolation between users.