17 of BBC's 90 “strictly necessary cookies” are for “tracking” users | Hacker News Reader

17 of BBC's 90 “strictly necessary cookies” are for “tracking” users

twitter.com

123 pointsmLuby9 comments

"If not present, could not track a user journey"

Yeah, that's kinda the point...

From the ICO page https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

This means you are unlikely to need consent for:

cookies used to remember the goods a user wishes to buy when they add goods to their online basket or proceed to the checkout on an internet shopping website; session cookies providing security that is essential to comply with data protection security requirements for an online service the user has requested – eg online banking services; or load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers.

From another ICO page: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

  Are analytics cookies exempt?
  
  No. It is important to note that PECR does not distinguish between cookies used for analytics activities and those used for other purposes. Analytics cookies do not fall within the ‘strictly necessary’ exemption. This means you need to tell people about analytics cookies and gain consent for their use.
  …
  Whilst analytics can provide useful information for you, they are not part of the functionality that the user requests when they use your online service – if you didn’t have analytics running the user could still be able to access your service. This is why analytics cookies aren’t strictly necessary and do require consent.

I used to think of the BBC as my favorite overseas news source (I'm American). They have disappointed me in several ways, though. Now they're just one of many I'll scan once in a while, but always with a grain of salt.

The BBC are one of the only organisations I have some sympathy for in this department. They are obliged to show value for money to the taxpayer and their budget is constantly under attack, despite a more or less universal acceptance they what they do is worthwhile. Even if they wanted to be cynical, they aren't in a position to monetize any data they collect anyway and it would be used as a stick to be them with if they were caught doing it.

Is this a GDPR violation?

Is the BBC subject to EU GDPR since Brexit? They may only be subject to UK law, although I'm not sure what the differences are: https://www.itgovernance.co.uk/eu-gdpr-uk-dpa-2018-uk-gdpr

If you interact with the EU or it's citizens, you are subject to it.

Well, that's a bit of a paper tiger. There's no cost to ignoring it, unless you have a dedicated European office or something like that.

Reply on news.ycombinator.com