Hacker News Reader

Comment by mikrosom | Hacker News Reader

Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?

View on HN

Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.

From my perspective as a user making me click those traffic lights isn't essential functionality.

But for the business, bot protection is essential. And GDPR talks about business perspective.

Surely, for a business, things like advertisement, tracking, etc. may also be essential.

When placing cookies, the bar to essential is actually really high.

It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality.

The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here!

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Not sure if I agree. Taken from your ICO link:

"This means you are unlikely to need consent for: - load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers."

You can put a lot of things in this exemption list. I risk to say, even Google Analytics.

GDPR talks about balancing business interests against individual rights.

Unless there's actually a captcha on that page, they aren't essential. Furthermore, you could argue that recaptcha itself is in breach of the GDPR as it collects a lot more data than necessary (captchas have been done just fine for decades without collecting any personal information).

That isn't how reCaptcha works though. v3 doesn't even show challenges anymore. It wouldn't work at all without analyzing user metrics.

Well then maybe it's not compliant with data protection legislation if they need to analyse user behaviour without consent.

Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.

This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.

> Slack has no control over those cookies

Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?

Reply on news.ycombinator.com