Hacker News Reader

Wait...so the rule is

> These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user

How do you explain to the user what those cookies do and why they are necessary?

Is it OK just to have an explanation on your site's terms of service page or on its legal page, or do you have to put it somewhere you are sure the user will see?

its ok to have an explanation on your privacy policy or cookie policy pages.

you do not need to issue a pop-up, you just need the user to be able to find the explanation if they want to.

> what they do and why they are necessary should be explained to the user.

Which would require showing this info somewhere even for essential cookies. Is a popup required for this?

No, a popup is not required, it can be part of the privacy policy.

https://termly.io/faq/do-i-need-a-cookie-policy-on-my-websit...

That website has a popup when I load it from the UK.

"We use essential cookies to make our site work. With your consent, we may also use non-essential cookies to improve user experience and analyse website traffic. By clicking 'Accept', you agree to our website's cookie use as described in our Cookie Policy. You can change your cookie settings at any time by clicking “Preferences”. Preferences/ Decline/ Accept"

yes. they set marketing and tracking cookies.

if you're not doing that then they're telling you that you don't need a pop-up.

Thanks, useful information.

A bit funny that this page does show a large popup so that you can accept their use of cookies.

I never want to accept popup that isn't required. Why do we even have that.

Analytics are necessary - without analytics sites' design would be much worse.

They don't meet the legal definition of strictly necessary.

They don't really "track you" in any meaningful way - the most interesting info in the gov.uk cookies seems to be language (English or Welsh) and if the user provides it, country (England, Wales, Scotland or NI).

Still, the data falls under GDPR, so we get consent dialogs.

https://www.gov.uk/help/cookie-details

the ones you mention would fall into “essential use”, since its first party and is used for functionality on the site.

what you didnt mention is that:

> We also use LUX Real User Monitoring software cookies from SpeedCurve to measure your web performance experience while visiting GOV.UK.

stuff like this is why they need the consent dialog.

if instead of embedding tracing cookies and analytics JS they processed access logs, they would learn a lot without needing the dialog. However, since everyone just throws up the dialog (and users are trained to expect it) its “not worth solving”.

Here's a more plausible and less cynical take:

Most people, whether in government or in business, can't give a flying fsck about GDPR or whatever. They just want to get their primary job done, and to them stuff like GDPR is just legal red tape that's imposed on them and that serves no value whatsoever, merely serving as roadblocks slowing them down from doing their real job. They don't want to understand the intricacies of GDPR, they just want to get it over with as quickly as possible, which means slapping a cookie banner on the site, checking the "I am now compliant" checkbox that the GDPR officer nagged them with, and calling it a day. They don't want to go through the trouble of researching a couple of weeks what the best user-friendly way is of being GDPR compliant when they can just install a cookie banner in 5 minutes.

Sounds familiar? If you're a developer in a large corporation then I'm sure you have also been annoyed by the tons of security and firewall rules, and most of you would rather work around them than trying to understand why they exist and how to best comply to them both in mechanics and in spirit. Just like you're not deliberately trying to be evil and breaking the company's security, they're not deliberately being evil and trying to violate privacy.

So it is an UX problem.

Most people don't give a fuck about anything that isn't related to their current task. However, there are laws, and company must give a fuck about it and do such UX so that those that don't give a fuck are not fucked on spot.