Hacker News Reader

Comment by TonyTrapp | Hacker News Reader

One minute wasted watching this and it doesn't even show the contents of those cookies. Without looking at the contents, it's impossible to tell if they are "necessary for site functionality", for which you do not need consent (as you can see in the video, there is no checkbox for that sort of cookies, they are always active).

View on HN

Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?

Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.

This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.

> Slack has no control over those cookies

Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?

Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.

Unless there's actually a captcha on that page, they aren't essential. Furthermore, you could argue that recaptcha itself is in breach of the GDPR as it collects a lot more data than necessary (captchas have been done just fine for decades without collecting any personal information).

That isn't how reCaptcha works though. v3 doesn't even show challenges anymore. It wouldn't work at all without analyzing user metrics.

Well then maybe it's not compliant with data protection legislation if they need to analyse user behaviour without consent.

From my perspective as a user making me click those traffic lights isn't essential functionality.

But for the business, bot protection is essential. And GDPR talks about business perspective.

GDPR talks about balancing business interests against individual rights.

When placing cookies, the bar to essential is actually really high.

It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality.

The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here!

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Not sure if I agree. Taken from your ICO link:

"This means you are unlikely to need consent for: - load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers."

You can put a lot of things in this exemption list. I risk to say, even Google Analytics.

Surely, for a business, things like advertisement, tracking, etc. may also be essential.

No cookies are 'necessary' for site functionality, unless there is a login needed.

No cookies are 'necessary' to just display information, pics and videos.

From GDPR.eu:

> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.

Seems like you can in fact set first-party session tokens without consent. Does not seem like you need a specific reason to do so.

Only if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though.

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

So I'd argue it does need to be a specific reason, at least if you follow the ICO guidance (which is probably the best I've found for explaining what's required by the ePrivacy directive)

Strictly necessary can also include security measures, of which session IDs tend to be a part of.

bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some.

heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

no you don't unless authentication is needed. How is post request and cookie even related? It is simple web dev 101.

You need to store some kind of state if you want to protect the form from CSRF attacks. You usually want to protect the form.

You don't need a cookie for that though... Even a window variable would suffice

I have a form on my site. My site has no cookies.

I have no issues.

If you don't even have a CSRF you actually probably have an issue that you are not aware of.

It's an email signup form so it's fine.

Reply on news.ycombinator.com