Comment by whoknowswhat11 | Hacker News Reader

Comment by whoknowswhat11 | Hacker News Reader

Parent Full thread

I went to their website in incognito mode.

https://ec.europa.eu/info/privacy-policy/europa-analytics_en

Before accepting any cookies I got a _pk_id cookie expiring in 13 months.

They are clear this is what will happen.

Just check it for yourself before you listen to the lies / blather you read here.

The EU's own websites track you on first landing.

Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it.

The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.

> until you gave consent or denied it [emphasis mine]

That seems fine. Not the greatest UX but as long as you're able to decline it should be compliant.

I'm not giving a legal opinion, but some say that

"Consent must be freely given, specific, informed and unambiguous."

So a question remains, if you give someone the option to decline to be tracked, is that enough? Or do you need actual consent?

The EU website is doing the tracking with option not to be. Other experts say you really should have consent first before doing any tracking.

Anyways, not giving my opinion on which is right, just that there are different views, and even EU does it in ways I think that folks here do not understand.

The one thing, the EU sites are extremely CLEAR about things, I do like that.

You need actual consent in order to store personal data.

I don't think the UK GDPR differs yet from the EU one, so the ICO guide might still be useful. I find it much clearer than guidance I can find from the EU: https://ico.org.uk/for-organisations/guide-to-data-protectio...

Strange, I get different cookies to you. I get one session cookie called 'has_js' and one called 'cck1' that expires in six months.

I'm sure GDPR allows for the setting of cookies, just not the storage of personal data without explicit consent.

Reply on news.ycombinator.com