Hacker News Reader

Comment by 1f60c | Hacker News Reader

A lot of websites seem to place cookies before you can consent to them doing so.

I just loaded up the home page of The New York Times (a random example), and it had placed 23 cookies on my laptop before the "Your tracker settings" window finished loading. Now I still haven't clicked "ACCEPT", and we're up to 43.

View on HN

23 tracking cookies? Cookies have other uses.

My understanding has always been that no consent = no cookies of any kind. Am I wrong?

most of the web wouldn't function at all without cookies.

my understanding is no consent = no tracking cookies. session cookies are okay.

IANAL, though, so I could be incorrect.

Read-only sites ought work without cookies. Perhaps part of the issue is that disabling cookies via APIs makes the {session,local}Storage objects throw exceptions instead of only storing the issues for the duration of the current browsing context, which breaks a lot of javascript that doesn't handle these exceptions and a lot of badly written sites depend on javascript to even render something.

Why not? Assuming NYT has free pages and I want to access one of them, what do they need a cookie for?

> most of the web wouldn't function at all without cookies.

To be fair, though, that's pretty clearly a bug; at a minimum, any site that's just serving content should be fine with no cookies. Of course, any site that's just content should also be at least 95% functional with no JS and barely any CSS, and we all know how that worked out...

> To be fair, though, that's pretty clearly a bug

No doubt. I was just making a statement about the current state of the web. Not applauding it in the least. :)

Nope, the law allows cookie that are necessary for a functionnality that allows the communication or is asked by the user.

For exemple, as I said in another post, is explicitely allowed:

* Cookies for login/session

* Cookies for shopping carts

* Cookies for interface personnalisation (language, etc.)

* Cookies for load balancing

* Cookies to retain user choice regarding cookies

And quite a few other. So really you can run your website without consent notice if you care enough. One grey area is analytics, it varies amongst european DPAs. That I know of:

* In France it is allowed if you respect a few rules (no cross-processing, no localisation, etc..)

* In the UK, it is not per say allowed, but the ICO said they would not prosecute on those grounds.

I would imagine that _placing_ the cookies isn't against the law; it's doing something with them when the visitor returns or navigates to another page. But IANAL and IDART (I don't actually read things).

Technically necessary cookies are fine. If those go beyond that it would be against the law... If you're in the EU.

Reply on news.ycombinator.com