Comment by jshmrsn | Hacker News Reader

Comment by jshmrsn | Hacker News Reader

Parent Full thread

Well, I am trying to inform myself because I did understand the cookie popups to be connected to GDPR. As far as I can tell from my reading, your assertion that "cookie popups have nothing to do with GDPR" is not true.

From my reading, it seems that while cookie permissions first became an explicit EU law concept in a 2009 amendment to ePrivacy Directive (not GDPR), companies were able to get away with passive consent banners (not popups).

It was GDPR's new definition of consent which then retroactively strengthened the existing ePrivacy Directive cookie consent to explicitly require user action to give consent (i.e. popups, banners large enough to push users to interact with them, etc.).

Unless your point is that GDPR has nothing to do with popups because the companies could just not use non-strictly-necessary cookies and therefore not need a popup, but I think that's a stretch to jump from there to "nothing to do with GDPR".

https://gdpr.eu/cookies/

https://wp-gdpr.eu/gdpr-cookie-consent-2026/

https://eulawanalysis.blogspot.com/2022/01/consent-and-cooki...

> (i.e. popups, banners large enough to push users to interact with them, etc.).

"i.e." doing a lot of work there.

GDPR doesn't require pop-ups or banners for providing consent. It mentions "ticking a box when visiting an internet website" as an example implementation. But it's just there as an example.

https://gdpr.eu/Recital-32-Conditions-for-consent/

the mechanism for gathering consent is an implementation detail left to the site to handle because GDPR applies to far more than websites. i've had to provide consent for things completely unrelated to websites.

you could add a line of text saying "please write us a letter with the following information (user account, blah, blah) if you are willing to provide consent for optional tracking like blah blah" and this is perfectly in line with GDPR.

sure, it's more expensive and you'll get fewer people who you can track. but make no mistake, sites make a decision and choose pop-ups/banners as their implementation for gathering consent because they don't want to lose out. they're happy inflicting pop-ups/banners on their users instead so they can keep their precious tracking cookies going.

i.e. GDPR doesn't require pop-ups/banners, sites choose pop-ups/banners.

Reply on news.ycombinator.com