4 ms·
Remember, according to the GDPR: * any strictly necessary cookies do not require consent * any preference/functionality cookies require consent, but the user
by o11c 2y ago
Remember, according to the GDPR:
* any strictly necessary cookies do not require consent
* any preference/functionality cookies require consent, but the user has to go looking for them anyway
Thus, preemptive cookie banners are only needed for the "this is an evil website" case.
- arresin 2y agoI believe you can still do telemetry even, it just has to be anonymised.
- Kerrick 2y agoEvil, really? Is a simple A/B test where you want to see whether using the phrase “sign up” or “register” on the landing page is more effective evil? Even if you have no desire to track individuals and you just want to know which phrase is more helpful in aggregate? Storing the data necessary to learn this requires consent, doesn’t it?
- loloquwowndueo 2y agoYes it’s evil.
- deleted 2y ago[deleted]
- selfhoster11 2y agoIMO, yes. You are storing data you don't need to store, and adding a (small) fingerprint to the user's persistent profile with your site - so don't store it. Losing the ability to run A/B tests is not a big deal.
- marcosdumay 2y agoIt requires consent if it's personal information. You can pretty much do an A/B framework that doesn't require consent. You will absolutely be prohibited from running any of the popular options we have today.
- ghusto 2y agoYes. Do it without personal information. If your intent is only to A/B test, you don't need to tie that to individuals, unless your intent is also to target those particular types of individuals.
- jdlshore 2y agoYou’re confusing the GDPR and the ePrivacy directive. (And maybe getting that wrong too. I’ve read the GDPR but not the ePrivacy directive. Oh, and IANAL.) The GDPR doesn’t require consent for cookies. What it requires is a lawful basis for tracking people’s personal information. Most of those lawful bases don’t require consent either. The only time the GDPR requires consent is when somebody wants to collect your personal information and they don’t have a good reason to do so. Then they have to ask, they have to make it easy for you to decline, and they have to make it easy for you to withdraw your consent later. They also can’t withhold anything from you if you decline. They can’t charge more for their services, block it from your access, etc. That’s what the GDPR has to say about consent. Nothing to do with those cookie banners, which are the result of scummy companies doing scummy things.
- lmkg 2y agoGP are wrong about which law applies, but they are applying that law correctly. The ePrivacy Directive requires consent to read or write from the user's terminal device, except when strictly required for the functionality the user requested. Unlike GDPR, it does not allow a different Legal Basis. It must be consent, or strictly functionally necessary. Nothing else. The passage of GDPR did impact the ePrivacy Directive in that it updated the definition of "consent." The ePD doesn't have one; it referenced the definition in the DPD, which was replaced by GDPR. This is why people blame the GDPR for cookie banners, although really it's incidental.
- jdlshore 2y agoGreat clarification, thank you.
- aurareturn 2y agoThus, preemptive cookie banners are only needed for the "this is an evil website" case. Like this one? https://gdpr.eu/cookies https://gdpr.eu/cookies And basically all EU government websites?
- o11c 2y agoI see at least two evil things trying to load on that page.