4 ms·
Don’t use a bunch of unnecessary tracking cookies? Completely eliminates the need for a cookie permission bar.
by dghlsakjg 2mo ago
Don’t use a bunch of unnecessary tracking cookies?
Completely eliminates the need for a cookie permission bar.
- pie_flavor 2mo agoThe law does not say 'tracking'. It says 'strictly necessary'. If you remember the user's light/dark theme preference in a cookie, that requires notification. (Or rather, what it requires in practice is that you hire a Highly Paid Consultant.)
- dghlsakjg 2mo agoOkay, but it doesn’t require notification for every user that hits your landing page. If you want to remember dark mode with a cookie, then you can just gate that setting behind a “allow functional cookies” toggle. Getting consent for functional cookies doesn’t have to be done with an intrusive cookie bar on landing. You can request consent as it becomes needed. There’s other ways of complying that aren’t dark patterns.
- inigyou 2mo agoCan you please tell me what part of this law requires any sort of notification or toggle whatsoever for remembering your dark mode setting: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- dghlsakjg 2mo agoYou're replying to me, but I'm not the one asserting it. The GDPR law doesn't require it specifically, but the earlier ePrivacy regulation does and it is considered to be the guide for GDPR on this specific issue. Lex Specialis is the term for one regulation being applied within a different one. In any case here is a plain text interpretation from the EU (https://gdpr.eu/cookies/ https://gdpr.eu/cookies/): "Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in." Farther down: "To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. ..." So a preference cookie is categorized differently than "strictly necessary" by the ePrivacy rules predating, but now part of, GDPR. But elsewhere in this thread someone asserted that a cookie that is placed and the data never sent back to the server is exempt, so if you handle dark mode entirely client side you might be ok? I'm beginning to understand why the lawyers in the EU just say "fuck it, put a banner up"
- clan 2mo agoNonsense. You are correct that people keep stating such things. But it is incorrect. That example would be an essential cookie, also known as a strictly necessary cookie. A shame this FUD is still being spread.
- pie_flavor 2mo agoThat's not what various references (and AIs) say. Strictly necessary means strictly necessary. They didn't bother defining it in the law. However, user preferences were called out specifically in the WP29 opinion as something that wouldn't count as strictly necessary if scoped any wider than the browser session. So if the plain English meaning and the drafters' opinion contradicts your opinion, why should I risk significant fines to trust it?
- inigyou 2mo agoYeah well most references on this are wrong, and AIs are doubly wrong since they ingest those references and also since they are AIs. I suggest actually reading the GDPR if you think it applies to you. The EU put it up on a website for everyone to see. Here's the most relevant section: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Notice how cookies are not mentioned, popups are not mentioned, and strictly necessary is not mentioned. Those are requirements the data harvesting industry invented out of whole cloth. They are not the actual requirements. I'll just repeat that one more time: the GDPR does not mention cookies or popups. Let that sink in. It's all cargo-cult. The GDPR also doesn't give a shit about dark mode preference. Literally nothing in it has any relevance to a dark mode preference, even (and especially) if you store it in a cookie.
- dghlsakjg 2mo agoSee my other response with citations. In short: the GDPR doesn't mention it but it is covered by the ePrivacy directive/regulations which does cover cookies very specifically, and which is enforced through GDPR.
- 2mo ago
- rcxdude 2mo agoNo, it doesn't. If it's reasonably expected as part of the service, you don't need to gather consent. It's not even personal data.
- pie_flavor 2mo agoThe law does not say 'reasonably expected', it says 'strictly necessary'.
- rcxdude 2mo agoSorry, getting my GDPR and e-privacy terms mixed up. The cookie is strictly necessary for the setting to be saved. The user has specifically requested that the setting be saved by changing it. The opinion suggests this should be a session cookie unless you indicate somewhere prominently next to the setting that it uses cookies to store it for longer. This still doesn't require a cookie banner. What's more, if the 'cookie' is entirely local (i.e. it's never sent back to your own server, e.g. you're using the local storage API and the javascript on your page never puts that information into a request), like how this would normally be implemented nowadays, then these requirements don't apply at all (because a cookie according to the law is just something your server gives to the user's device and then the device gives back later).
- wat10000 2mo agoOK, so don't do that. Web sites work fine without remembering anonymous users' preferences across sessions.
- inigyou 2mo agoCan you point to the law in question?
- account42 2mo agoa) The law does not require a notification for this use of cookies. b) Please don't re-implement OS/browser functionality in your website.
- vovavili 2mo agoI am obviously referring to a scenario where tracking cookies would be highly beneficial to expanding the business, e.g. e-commerce.
- ranger207 2mo agotracking cookies are so obviously beneficial to e-commerce that they passed an entire law to disclose them because people... liked them so much?
- vovavili 2mo agoI don't exactly see how these two statements are contradictory. Policy is about conflicting interests.
- dijit 2mo agoDon't set a tracking cookie, use of IP addresses is allowed for legitimate purposes (Art 6(1)(f)) as long as they're not stored. At least for GDPR... The only ways to actually track without a consent pop-up are: (1) stay off the device entirely and process server-transmitted data under legitimate interests with a privacy notice, or (2) confine any device storage to what's strictly necessary for the service the user requested
- vovavili 2mo agoThis goes to show that the assertion that cookie banners are just "malicious compliance" isn't quite correct. These are significant trade-offs here.
- dijit 2mo agoyou don’t need to track users by giving them an ID they send with every request. in fact. you probably don’t need to track users.
- dghlsakjg 2mo agoSomething being beneficial to a business does not make it broadly necessary, desirable, or - in many cases - legal. It would be extremely beneficial to businesses to put a clause in their terms and conditions that limit damages to 1 cent in the event of any dispute. For obvious reasons we don't allow anything like that to be enforced. I'm not saying whether tracking should or shouldn't exist, but "the business can make more money" is not a valid argument in my book.