Hacker News new | past | comments | ask | show | jobs | submit
dghlsakjg | on: Every Fucking Website (2020)
Don’t use a bunch of unnecessary tracking cookies?

Completely eliminates the need for a cookie permission bar.

pie_flavor | parent | next
The law does not say 'tracking'. It says 'strictly necessary'. If you remember the user's light/dark theme preference in a cookie, that requires notification. (Or rather, what it requires in practice is that you hire a Highly Paid Consultant.)
rcxdude | root | parent | next
No, it doesn't. If it's reasonably expected as part of the service, you don't need to gather consent. It's not even personal data.
pie_flavor | root | parent
The law does not say 'reasonably expected', it says 'strictly necessary'.
loading story #49301852
dghlsakjg | root | parent | next
Okay, but it doesn’t require notification for every user that hits your landing page.

If you want to remember dark mode with a cookie, then you can just gate that setting behind a “allow functional cookies” toggle.

Getting consent for functional cookies doesn’t have to be done with an intrusive cookie bar on landing. You can request consent as it becomes needed. There’s other ways of complying that aren’t dark patterns.

wat10000 | root | parent | next
OK, so don't do that. Web sites work fine without remembering anonymous users' preferences across sessions.
clan | root | parent
Nonsense.

You are correct that people keep stating such things. But it is incorrect.

That example would be an essential cookie, also known as a strictly necessary cookie.

A shame this FUD is still being spread.

pie_flavor | root | parent
That's not what various references (and AIs) say. Strictly necessary means strictly necessary. They didn't bother defining it in the law. However, user preferences were called out specifically in the WP29 opinion as something that wouldn't count as strictly necessary if scoped any wider than the browser session. So if the plain English meaning and the drafters' opinion contradicts your opinion, why should I risk significant fines to trust it?
vovavili | parent
I am obviously referring to a scenario where tracking cookies would be highly beneficial to expanding the business, e.g. e-commerce.
dijit | root | parent | next
Don't set a tracking cookie, use of IP addresses is allowed for legitimate purposes (Art 6(1)(f)) as long as they're not stored.

At least for GDPR...

The only ways to actually track without a consent pop-up are:

(1) stay off the device entirely and process server-transmitted data under legitimate interests with a privacy notice, or

(2) confine any device storage to what's strictly necessary for the service the user requested

loading story #49301010
ranger207 | root | parent
tracking cookies are so obviously beneficial to e-commerce that they passed an entire law to disclose them because people... liked them so much?
loading story #49301034