4 ms·
They do come from the ePrivacy directive but; > if you want to store data on the user's browser you do need to get their consent, hence the cookie banner. No
by maccard 28d ago
They do come from the ePrivacy directive but;
> if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.
No - you need consent for storing cookies that are not “strictly necessary”. I can implement an offline app that stores data in cookies without consent. The current usage of the banner is overly litigious US focused simplification combined with malicious compliance.
- brainwad 28d agoNo cookie is strictly necessary, you can encode it all into request tokens in the URL, so this is a meaningless exception.
- jampekka 28d agoThe law is not about cookies specifically, it's technology neutral. The law doesn't even include the word cookie anywhere. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
- bryanrasmussen 28d agolet me guess: you're some sort of programmer?! For a programmer of some sort this may seem a meaningless exception, for a lawyer it is not. I am not a lawyer, but I have had a few law classes and worked a bunch in the legal services branch. If I am asked legally speaking - is this cookie strictly necessary? I will ask is the cookie used only for the purposes of the service provided to the user and which the user expects to get. If the cookie is used so that when the user logs in and goes to page two of the article they are reading they can read that article without having to log in again we can say it is needed for the service. If the cookie is used to provide recommendations for other articles by using their user history to compare with other user histories and what other users like to read it is not needed for the service. Although from the point of view of the company it sure might be nice to have. If the cookie is used for your state management of the items you have placed in your basket so that you can go to buy those items it is needed, if the cookie is used to look up your past history and give you recommendations for other stuff to put in your basket, things you bought in the past why not buy some more of those, or how often you rated products you bought badly or anything not required for the current transaction you are doing to go smoothly it is not needed. As a general rule lawyers and the courts are good at sorting this stuff out, but as edge cases get complicated so does code, and nobody wants to handle all that stuff themselves, so instead they pay for a company that develops cookie banners and everybody gets asked if they accept cookies or not.
- rcxdude 28d agoThe ePrivacy directive basically defines it as 'any data your site gives to the user's terminal that the terminal then passes back to your site'. Request tokens in the URL would qualify, but notably storing something in localStorage with javascript that is never sent back would not.
- ninkendo 28d agoSo you’re saying if I log into HN, every intra-site link should be rendered with “?token=<secret>” and if I send a link to a friend it will let them be logged in as me? No, because that would be ludicrous, cookies are obviously necessary for the concept of a “login” or even just a “session” to exist.
- nraynaud 28d agoin particular, if you store stuff in the browser, and don't send it to the server later (local storage or one of the other 1000 JS APIs), there is no reason to present a cookie banner.
- beej71 28d agoDo you have an example of a maliciously-complying website? Virtually all remotely popular websites deliberately use unnecessary cookies.
- yencabulator 28d agoWanting to use unnecessary cookies is their choice, not something a law forced on them. Non-malicious compliance with privacy laws would mean respecting people's privacy.
- beej71 28d agoMaybe I'm ignorant of the gdpr, but does it ban tracking cookies?
- yencabulator 27d agoYou might be ignorant on purpose. The law does not mention cookies at all, it says how personal/private information must be handled, and under what conditions collecting such is permissible.