I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.
If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that?
The fact is most website operators want to use your data for non-essential purposes.
50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.
I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.
You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.
What makes that a legitimate interest and not advertising?
This part I guess
On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…
I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).
Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.
It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
> it was never about the cookies themselves.
The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive.
> Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt?
And on tracking-less cookies not requiring one - that’s my entire point.
That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".