Hacker News Reader

Comment by culturedsystems | Hacker News Reader

Note that you still need to get consent for the cookie in this case, as the cookie is being used for something which isn't strictly necessary to provide the service.

View on HN

I think this is kind of interesting question actually. If this cookie is entirely separated from the rest of the experience (e.g. _never_ gets associated to a logged in cookie, or IP address, etc.), is it really tracking the user? It's more like tracking article association. I agree it's not strictly necessary to provide the service, but is it necessarily tracking users at all? Another similar approach would be to keep the clients IP address as a similar key, but in that case the IP address can often be used to (at least closely) identify the client, but if the UUID is randomly generated it's a bit different.

I mean my gut feeling is that you're correct, but I kind of wonder about this case.

edit: A cursory reading of this site makes me think you are correct:

https://www.privacypolicies.com/blog/eu-cookie-law/

If the cookie is never used until a later date e.g. conversion, when the user clicks through an agreement, do you still need consent?

Edit: I honestly have no idea, I haven't read the regulations and I'm curious if any experts know. Seems sleazy regardless!

What does it mean? Even a session cookie is used at a later date, e.g. 5 minutes later. The law does not specify minimum retention time.

What if the cookie is also used for feature toggles?

Reply on news.ycombinator.com