8 ms·

> Legally-required cookie banner > PostHog.com doesn't use third-party cookies, only a single in-house cookie You're legally required to let me opt out of tha

> Legally-required cookie banner > PostHog.com doesn't use third-party cookies, only a single in-house cookie You're legally required to let me opt out of that cookie. Unless it's essential to the site functionality, in which case you don't need the banner at all.

rmunn 1y ago
Considering they have a login system, I'm going to guess that the cookie includes your login (probably in JWT form), which automatically makes it essential to site functionality. Which means the banner is there just because if it was absent, someone would say "Hey, where's the cookie banner?" In other words, it's not actually legally required in their case, but it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law.
- JoshTriplett 1y ago
  It is not in any way required, and adding it just contributes to annoyance.
- weird-eye-issue 1y ago
  > it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law. Your "logic" is baffling
  - rmunn 1y ago
    What I mean is that if they don't add it, they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner". Those regulators don't have any way of knowing how their site operates, so the small banner at least manages to inform them and keep Posthog from receiving emails. That is what I meant by "practically". I mean "in a practical sense" as opposed to in a theoretical sense.
    - notpushkin 1y ago
      Those regulators will need to study their own laws better then.
      - argomo 1y ago
        There's a general principal in regulated businesses that it's best to be above suspicion and below the radar at all times. You don't want to give regulators or opponents (such as competitors or advocacy groups) any ammunition. This is how you minimize headaches and your legal bill. And on the day that people come after you for some unforeseeable tragedy or perhaps genuine wrongdoing (covered up by unscrupulous employees or less-than-honest vendors), you'll be better positioned to deflect legal repercussions and bad press. The unnecessary cookie banner is a no-brainer: it costs you nothing and poses but a minimal irritant to users.
    - xboxnolifes 1y ago
      And they can reply back: "Hey, you're wrong".
      - pembrook 1y ago
        Doesn’t usually go over well with regulators. If they have to prove their site is fully compliant in court it would become mighty expensive to do so. So, cookie banner it is.
        stevesimmons 1y ago
        That's not how the process works.
        pembrook 1y ago
        GDPR has nothing to do with cookie banners first of all. Also, literally how the process works is, any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines and have to prove compliance to an incompetent non-technical person to stop the inquiries. It’s easier to throw up a banner, hence why most lawyers recommend this regardless of what you’re doing.
- zejn 1y ago
  It's not legally required in terms of law, but it is legally required in the way that the legal department will complain if the banner not there. Checklists and all that. ;)
ttiurani 1y ago
Exactly. If they indeed only use the cookie for essential functionality, this kind of joke banner only makes their choice to respect visitors' privacy equally annoying. Even worse: because it makes it seem like the EU law is just meritless pestering of people, they are actually fighting for the right for worse sites to spy on their visitors. It's baffling.
- xp84 1y ago
  > EU law is just meritless pestering of people It is that. It has done literally nothing to improve anything whatsoever, in any country. And most of the "cookie management" scripts that people use, barely even work. Both the law and the way it's complied with in practice are a dumb solution to a problem that the EU should have forced browser vendors to solve. Only the user's browser can choose not to send back cookies, and it would be trivial for the user to be shown a dialog when they navigate to a previously-visited site in a new session saying: Last time you were here, the site stored information that may help them recognize you or remember your previous actions here. < I want to be recognized > / < Forget Everything > [ ] Also keep these third-party cookies <Details...> [x] Remember my choice and don't ask again for ycombinator.com
  - ttiurani 1y ago
    How would that prevent sites from selling their users' data to third parties without consent server-side? GDPR is not about third party cookies, but about requiring informed consent.
    - vouwfietsman 1y ago
      Though I agree with your point, the idea that cookie banners in any sense contribute to "informed consent" is very debatable.
      - kiicia 1y ago
        It’s because those were made to be bad solution by very advertising companies wanting people to be denied their rights and making it look like law is bad instead of implementation being bad
almosthere 1y ago
Man it's 2025 and we still WANT to opt out of cookies visually? Why don't we just have browsers that just do that.
- joquarky 1y ago
  Seems like it should be a browser setting that controls a request header.
  - benjiweber 1y ago
    Something like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ? Which failed in part because Microsoft turned it on by default which even further disincentivised publishers from respecting it.
    - catlifeonmars 1y ago
      No your browser can just… choose not to send cookies. The website publisher has no say in that.
      - 9rx 1y ago
        Cookies are the easiest way to keep track of a user, but if browsers regularly stop sending cookies then website operators will just find another method to fingerprint users and then we're back to square one with the law still requiring publishers to receive opt-in approval, but with no requirements on how.
        quectophoton 1y ago
        > then website operators will just find another method to fingerprint users Example: The identifier you get when you pass anti-bot challenges (Cloudflare, Anubis, etc).
        Thorrez 1y ago
temptemptemp111 1y ago
[dead]
coded_monkey 1y ago
I’m interested to hear which country forces a cookie banner for any cookie, because the EU only requires it for tracking cookies and this website does net specify whether it’s used for that purpose. I’ve created websites with a cookie banner “because it’s required” even though there were no cookies involved. The idea that every website needs a cookie banner is more hurtful than the cookie banners themself.
- esskay 1y ago
  I rarely if ever put a cookie notice as the sites I tend to work on are only going to have 1 cookie for user sessions which is essential functionality and thus cannot be opted out of. It doesn't collect/store/share data so it's not something that needs the opt out banner. It's still stupid though as most of the sites I do absolutely still track certain activity, it's just done server side.
internet_points 1y ago
Could it be that they actually did not know that they don't need to show a banner if there is no third party cookie? Or that this is their way of bragging that they don't use third-party cookies?
pembrook 1y ago
Ahh yes. HN’s favorite debate. Where people who’ve never started a company or spoken to a lawyer about GDPR, the ePrivacy directive, the schrems rulings, etc but just emotionally love idea of what they think it represents (but actually doesn’t), debate with normal sane people. All I can say is, I’m getting really tired of this one guys.
- fsflover 1y ago
  Just like a debate on any other topic? E.g., GNU/Linux on desktop.
oliwarner 1y ago
Different jurisdictions differ. Even if you collect your own and it contains identifying points, laws like GDPR will require you to attain informed consent before you collect it, along with methods for people deleting their data, and a million et als.
jeroenhd 1y ago
I don't see any cookies saved anywhere. I do see four variables in localStorage, though. They also embed Youtube if you open the demo, which in turn tracks users (yes, even through the no-cookie subdomain: https://dustinwhisman.com/writing/youtube-nocookie-com-will-still-track-user-data/ https://dustinwhisman.com/writing/youtube-nocookie-com-will-...). Ursula von der Leyen would not be very proud.
- Garlef 1y ago
  Let's see if one of these shady lawyers who make their money by finding these violations reads HN and gets into contact with them...
thecopy 1y ago
>Unless it's essential to the site functionality, in which case you don't need the banner at all. No, this is conflating "GDPR consent" and the ePrivacy Directive. According to ePD the banner must always be shown if the company providing the service is based in the EU
elygre 1y ago
> You're legally required to let me opt out of that cookie. Unless it's essential to the site functionality, in which case you don't need the banner at all. Isn't it even simpler: Unless the cookie is used to track, you don't need the banner? For example, a cookie used to remember sort order would not require a cookie banner, I think. (It's not about cookies. It's about tracking.)
- Etherlord87 1y ago
  It's about being "essential" or not, not about tracking. Also keep in mind with enough preferences you could have unique or near-unique fingerprint of preferences which could be used for tracking.
deleted 1y ago
[deleted]
lucideer 1y ago
I love this website but yeah that banner really bothered me. 100% appreciate the effort to reduce cookies & the commitment to avoid 3rd-party, the tongue-in-cheek "legally required" flies completely in the face of all that effort - especially given it's misinformed & not in fact legally required at all.
deleted 1y ago
[deleted]

rmunn 1y ago

Considering they have a login system, I'm going to guess that the cookie includes your login (probably in JWT form), which automatically makes it essential to site functionality. Which means the banner is there just because if it was absent, someone would say "Hey, where's the cookie banner?" In other words, it's not actually legally required in their case, but it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law.

JoshTriplett 1y ago
It is not in any way required, and adding it just contributes to annoyance.
weird-eye-issue 1y ago
> it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law. Your "logic" is baffling
- rmunn 1y ago
  What I mean is that if they don't add it, they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner". Those regulators don't have any way of knowing how their site operates, so the small banner at least manages to inform them and keep Posthog from receiving emails. That is what I meant by "practically". I mean "in a practical sense" as opposed to in a theoretical sense.
  - notpushkin 1y ago
    Those regulators will need to study their own laws better then.
    - argomo 1y ago
      There's a general principal in regulated businesses that it's best to be above suspicion and below the radar at all times. You don't want to give regulators or opponents (such as competitors or advocacy groups) any ammunition. This is how you minimize headaches and your legal bill. And on the day that people come after you for some unforeseeable tragedy or perhaps genuine wrongdoing (covered up by unscrupulous employees or less-than-honest vendors), you'll be better positioned to deflect legal repercussions and bad press. The unnecessary cookie banner is a no-brainer: it costs you nothing and poses but a minimal irritant to users.
  - xboxnolifes 1y ago
    And they can reply back: "Hey, you're wrong".
    - pembrook 1y ago
      Doesn’t usually go over well with regulators. If they have to prove their site is fully compliant in court it would become mighty expensive to do so. So, cookie banner it is.
      - stevesimmons 1y ago
        That's not how the process works.
        pembrook 1y ago
        GDPR has nothing to do with cookie banners first of all. Also, literally how the process works is, any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines and have to prove compliance to an incompetent non-technical person to stop the inquiries. It’s easier to throw up a banner, hence why most lawyers recommend this regardless of what you’re doing.
zejn 1y ago
It's not legally required in terms of law, but it is legally required in the way that the legal department will complain if the banner not there. Checklists and all that. ;)

ttiurani 1y ago

Exactly. If they indeed only use the cookie for essential functionality, this kind of joke banner only makes their choice to respect visitors' privacy equally annoying. Even worse: because it makes it seem like the EU law is just meritless pestering of people, they are actually fighting for the right for worse sites to spy on their visitors. It's baffling.

xp84 1y ago
> EU law is just meritless pestering of people It is that. It has done literally nothing to improve anything whatsoever, in any country. And most of the "cookie management" scripts that people use, barely even work. Both the law and the way it's complied with in practice are a dumb solution to a problem that the EU should have forced browser vendors to solve. Only the user's browser can choose not to send back cookies, and it would be trivial for the user to be shown a dialog when they navigate to a previously-visited site in a new session saying: Last time you were here, the site stored information that may help them recognize you or remember your previous actions here. < I want to be recognized > / < Forget Everything > [ ] Also keep these third-party cookies <Details...> [x] Remember my choice and don't ask again for ycombinator.com
- ttiurani 1y ago
  How would that prevent sites from selling their users' data to third parties without consent server-side? GDPR is not about third party cookies, but about requiring informed consent.
  - vouwfietsman 1y ago
    Though I agree with your point, the idea that cookie banners in any sense contribute to "informed consent" is very debatable.
    - kiicia 1y ago
      It’s because those were made to be bad solution by very advertising companies wanting people to be denied their rights and making it look like law is bad instead of implementation being bad

almosthere 1y ago

Man it's 2025 and we still WANT to opt out of cookies visually? Why don't we just have browsers that just do that.

joquarky 1y ago
Seems like it should be a browser setting that controls a request header.
- benjiweber 1y ago
  Something like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ? Which failed in part because Microsoft turned it on by default which even further disincentivised publishers from respecting it.
  - catlifeonmars 1y ago
    No your browser can just… choose not to send cookies. The website publisher has no say in that.
    - 9rx 1y ago
      Cookies are the easiest way to keep track of a user, but if browsers regularly stop sending cookies then website operators will just find another method to fingerprint users and then we're back to square one with the law still requiring publishers to receive opt-in approval, but with no requirements on how.
      - quectophoton 1y ago
        > then website operators will just find another method to fingerprint users Example: The identifier you get when you pass anti-bot challenges (Cloudflare, Anubis, etc).
        Thorrez 1y ago

temptemptemp111 1y ago

[dead]

coded_monkey 1y ago

I’m interested to hear which country forces a cookie banner for any cookie, because the EU only requires it for tracking cookies and this website does net specify whether it’s used for that purpose. I’ve created websites with a cookie banner “because it’s required” even though there were no cookies involved. The idea that every website needs a cookie banner is more hurtful than the cookie banners themself.

esskay 1y ago
I rarely if ever put a cookie notice as the sites I tend to work on are only going to have 1 cookie for user sessions which is essential functionality and thus cannot be opted out of. It doesn't collect/store/share data so it's not something that needs the opt out banner. It's still stupid though as most of the sites I do absolutely still track certain activity, it's just done server side.

internet_points 1y ago

Could it be that they actually did not know that they don't need to show a banner if there is no third party cookie? Or that this is their way of bragging that they don't use third-party cookies?

pembrook 1y ago

Ahh yes. HN’s favorite debate. Where people who’ve never started a company or spoken to a lawyer about GDPR, the ePrivacy directive, the schrems rulings, etc but just emotionally love idea of what they think it represents (but actually doesn’t), debate with normal sane people. All I can say is, I’m getting really tired of this one guys.

fsflover 1y ago
Just like a debate on any other topic? E.g., GNU/Linux on desktop.

oliwarner 1y ago

Different jurisdictions differ. Even if you collect your own and it contains identifying points, laws like GDPR will require you to attain informed consent before you collect it, along with methods for people deleting their data, and a million et als.

jeroenhd 1y ago

I don't see any cookies saved anywhere. I do see four variables in localStorage, though. They also embed Youtube if you open the demo, which in turn tracks users (yes, even through the no-cookie subdomain: https://dustinwhisman.com/writing/youtube-nocookie-com-will-still-track-user-data/ https://dustinwhisman.com/writing/youtube-nocookie-com-will-...). Ursula von der Leyen would not be very proud.

Garlef 1y ago
Let's see if one of these shady lawyers who make their money by finding these violations reads HN and gets into contact with them...

thecopy 1y ago

>Unless it's essential to the site functionality, in which case you don't need the banner at all. No, this is conflating "GDPR consent" and the ePrivacy Directive. According to ePD the banner must always be shown if the company providing the service is based in the EU

elygre 1y ago

> You're legally required to let me opt out of that cookie. Unless it's essential to the site functionality, in which case you don't need the banner at all. Isn't it even simpler: Unless the cookie is used to track, you don't need the banner? For example, a cookie used to remember sort order would not require a cookie banner, I think. (It's not about cookies. It's about tracking.)

Etherlord87 1y ago
It's about being "essential" or not, not about tracking. Also keep in mind with enough preferences you could have unique or near-unique fingerprint of preferences which could be used for tracking.

deleted 1y ago

[deleted]

lucideer 1y ago

I love this website but yeah that banner really bothered me. 100% appreciate the effort to reduce cookies & the commitment to avoid 3rd-party, the tongue-in-cheek "legally required" flies completely in the face of all that effort - especially given it's misinformed & not in fact legally required at all.

deleted 1y ago

[deleted]