4 ms·

I still don't get why every website has a cookie banner by default. I am data controller for several companies and have lots of exposure to GDPR. All my website

by alt227 3mo ago

I still don't get why every website has a cookie banner by default. I am data controller for several companies and have lots of exposure to GDPR. All my websites have no cookie banner, as they are not required. I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.

maccard 3mo ago
I’ve made a few sites for work that aren’t our primary focus. The sites used cookies for login and for “required purposes” (storing in progress state). We did all the tracking on the backend, no cookies or client side trackers. On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…
- jarofgreen 3mo ago
  > We did all the tracking on the backend Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.
  - maccard 3mo ago
    I do but we shouldn’t be talking about cookies in our cookie banner then.
    - crote 3mo ago
      That's why the usual phrasing is some variation of "Are we allowed to track you? We use cookies for that". It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
      - maccard 3mo ago
        You’re conflating GDPR and the ePrivacy Directive. They _should_ work how people imagine they do. > it was never about the cookies themselves. The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive. > Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one. Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt? And on tracking-less cookies not requiring one - that’s my entire point.
- JoshTriplett 3mo ago
  Sounds like your legal department is broken. You should fix that. I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).
  - maccard 3mo ago
    It was a 30k person company, I worked for a subsidiary and for better or worse that was not within my circle of concern or circle of influence.
esperent 3mo ago
> I guess that most companies just chuck it up there as a default 50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.
HiPhish 3mo ago
> I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".
reorder9695 3mo ago
Don't underestimate the argument of "just to be on the safe side". Someone running a business who doesn't know a lot about cookies will often just put a banner on as an easy arse covering mechanism even when not required.
- SoftTalker 3mo ago
  Or they had their site developed by an agency and the cookie banner is just part of their standard scaffolding for a new site.
- inigyou 3mo ago
  Let businesses who don't know what they're doing be outcompeted by businesses who know what they're doing.
- JoshTriplett 3mo ago
  Perhaps someone could publish a clear A/B test on how many views/conversions you lose by having a cookie banner?
- NopIdoN 3mo ago
  That doesn't work, because you have to list what cookies you're asking for. If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that? The fact is most website operators want to use your data for non-essential purposes.
kuerbel 3mo ago
If you use social media pixels, ad tracking, or performance analytics tools like Google Analytics a cookie banner and consent is required. If not, then not.
- alex_suzuki 3mo ago
  Side note: there’s plenty of Analytics tools that don’t require cookies. Plausible (https://plausible.io https://plausible.io) is one of them, there are many others. Not affiliated, just a happy customer.
  - charcircuit 3mo ago
    If you want to prevent a single user hitting F5 a million times from messing with your analytics you need to track IPs which requires the banner.
    - preg_match 3mo ago
      I'm not convinced this is a real concern. Bots, maybe, but then again even fancy analytics will be fucked by that because they use hundreds or thousands of high-reputation residential IPs. So, you're optimizing for the wrong thing I think.
    - TheCoelacanth 3mo ago
      No, you don't need consent for that. It falls under the legitimate interest exception. You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.
      - charcircuit 3mo ago
        >It falls under the legitimate interest exception. What makes that a legitimate interest and not advertising?
tete 3mo ago
> I guess that most companies just chuck it up there as a default so they dont have to read the law I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.

by alt227 3mo ago

maccard 3mo ago

I’ve made a few sites for work that aren’t our primary focus. The sites used cookies for login and for “required purposes” (storing in progress state). We did all the tracking on the backend, no cookies or client side trackers. On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…

jarofgreen 3mo ago
> We did all the tracking on the backend Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.
- maccard 3mo ago
  I do but we shouldn’t be talking about cookies in our cookie banner then.
  - crote 3mo ago
    That's why the usual phrasing is some variation of "Are we allowed to track you? We use cookies for that". It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
    - maccard 3mo ago
      You’re conflating GDPR and the ePrivacy Directive. They _should_ work how people imagine they do. > it was never about the cookies themselves. The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive. > Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one. Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt? And on tracking-less cookies not requiring one - that’s my entire point.
JoshTriplett 3mo ago
Sounds like your legal department is broken. You should fix that. I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).
- maccard 3mo ago
  It was a 30k person company, I worked for a subsidiary and for better or worse that was not within my circle of concern or circle of influence.

esperent 3mo ago

> I guess that most companies just chuck it up there as a default 50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.

HiPhish 3mo ago

> I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".

reorder9695 3mo ago

Don't underestimate the argument of "just to be on the safe side". Someone running a business who doesn't know a lot about cookies will often just put a banner on as an easy arse covering mechanism even when not required.

SoftTalker 3mo ago
Or they had their site developed by an agency and the cookie banner is just part of their standard scaffolding for a new site.
inigyou 3mo ago
Let businesses who don't know what they're doing be outcompeted by businesses who know what they're doing.
JoshTriplett 3mo ago
Perhaps someone could publish a clear A/B test on how many views/conversions you lose by having a cookie banner?
NopIdoN 3mo ago
That doesn't work, because you have to list what cookies you're asking for. If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that? The fact is most website operators want to use your data for non-essential purposes.

kuerbel 3mo ago

If you use social media pixels, ad tracking, or performance analytics tools like Google Analytics a cookie banner and consent is required. If not, then not.

alex_suzuki 3mo ago
Side note: there’s plenty of Analytics tools that don’t require cookies. Plausible (https://plausible.io https://plausible.io) is one of them, there are many others. Not affiliated, just a happy customer.
- charcircuit 3mo ago
  If you want to prevent a single user hitting F5 a million times from messing with your analytics you need to track IPs which requires the banner.
  - preg_match 3mo ago
    I'm not convinced this is a real concern. Bots, maybe, but then again even fancy analytics will be fucked by that because they use hundreds or thousands of high-reputation residential IPs. So, you're optimizing for the wrong thing I think.
  - TheCoelacanth 3mo ago
    No, you don't need consent for that. It falls under the legitimate interest exception. You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.
    - charcircuit 3mo ago
      >It falls under the legitimate interest exception. What makes that a legitimate interest and not advertising?

tete 3mo ago

> I guess that most companies just chuck it up there as a default so they dont have to read the law I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.