Privacy group targets website 'cookie terror'

My understanding is that so long as you're not a) using third-party cookies, or b) trying to track the user beyond what's necessary for your site to function in a reasonable way (and that's "technical function", not "necessary for me to pay the bills for my site"), you don't need to have any banner.

For instance, I run a small (and very niche) browser-based game, which has never done any advertising or tracking, not even Google Analytics. It needs a cookie to keep track of which account is logged in from any given browser, and another with a couple of per-device preferences for how the site should display, and that's it.

Latest EDPB guidelines I'm aware of are at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

The current banners barely even comply with the letter of the law, let alone the spirit of the law - most sites are still dropping the cookies before the user sees or interacts with the banner.

Assuming they actually do function (around half don't, in my experience), then you have different interpretations around even the size of buttons and their colour - current view seems to be that buttons should be equal in size and prominence, and that an accept all should be matched by a button to reject all (rather than forcing users to granularly opt out of each one).

I have no clue where the modern trend to claim legitimate interest around cookies arises from, but it has no legal basis in the UK for one, and similar true for other jurisdictions - in the UK, there are only 3 situations where identifiers can be used or placed (see PECR legislation and guidelines from the ICO) - due to the technical necessity of getting the bits and bytes to you, in order to deliver solely functionality requested by the user (setting session cookie for login, setting a shopping basket cookie due to a user adding an item to their basket etc.). Your final option is explicit GDPR-level consent. Legitimate interest is not an option.

The prevalence of presumed consent to use of third party and faux-first-party cookies for other purposes has no basis though - stats or telemetry etc are not permitted uses, as much as companies may cry... Either technical necessity to deliver bits and bytes, to deliver solely the user's explicitly requested functionality, or based on informed user consent.

Ironically if you do it right, you don't need any cookie banner! Just don't use cookies for marketing, targeting, tracking, or anything else that's hidden from the user - no cookie consent is required to let them browse, shop, check out, etc!

it makes the page linear, looks like hell and shows you the information most of the time.