Hacker News Reader

Comment by adnam | Hacker News Reader

FTA: "a cookie which was set to welcome a user back to a website, or to record what pages they view would not be strictly necessary"

I can imagine a good case for saying this kind of thing is essential from a usability perspective. Who's to say if it is "strictly necessary" or not?

View on HN

The spirit of the law is protecting the privacy of site visitors from being leaked to third parties, intentionally or otherwise, and gaining their informed consent before doing things with cookies that violate that privacy.

So the particular focus on third party cookies (be it 3rd party analytics tools and/or third party advert networks and/or 3rd party AB testing frameworks). These 3rd parties amass browsing habits and habits of visitors across multiple sites and topics. They use that information to build personalised profiles of an individual. This is done without the individual's consent. So the individual believes they've visited a set of independent websites, and they don't realise that some third party is watching over their shoulder. If they realise that is happening, and the implications of that, they would probably decline to participate, if they knew how.

So consider the use of cookies with that as a guide (but I am not a lawyer, if you are not absolutely certain, consult a lawyer).

I, for one, would be very surprised if a business got successfully sued for having a first-party cookie that clearly wasn't shared with any other site that was used to present a "Welcome back" message. Unless there was a third party script on the page watching for the appearance or non-appearance of that message.

I don't get what's so hard about the concept of "strictly necessary". If you take the cookie away and the site ceases to function such that the user cannot complete tasks they are there to do, then the cookie is strictly necessary. If the site continues to function, even if your business analytics are somewhat impaired, it's not strictly necessary and you need to gain the user's consent to set it.

Because the site may continue to function, but with reduced usability. I don't believe the new law says anything about analytics, just cookies which are not (waves hands) "strictly necessary". Just how much of a degradation in usability is acceptable is presumably a question for the lawyers.

There's a disconnect here. How does the absence of analytics mean the site continues to function with reduced usability? You could argue that over time the site's usability would not increase as much as it might be due to missing analytics data, but it won't be reduced just because the Google Analytics beacon isn't present on the page.

If you think that having analytics data is such a benefit to the user, explain to them why you want to track how they use your site and let them decide whether they're happy with that. That's all this law requires.

Again, the new law does not specifically mention "analytics" - the analytics issue is something that you yourself have come up with. If you read the guidelines, you'll notice that it states that consent does not need to be sought "where such storage or access is strictly necessary for the provision of [a service]". As I mentioned above, the provision of a service may have a usability component, for which cookies are necessary; however the service may work with degraded usability without such cookies. Would a degradation in usability make the cookies "strictly necessary", and if so, to what extent? This is something the new law does not address, and causes worry for web developers like me.

Reply on news.ycombinator.com