Timeline for GDPR Compliance: Do all Cookies require Opt-In?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 17, 2020 at 8:31 | history | edited | CommunityBot |
Commonmark migration
|
|
| Oct 2, 2018 at 13:13 | history | edited | Tardis | CC BY-SA 4.0 |
Links updates
|
| Jun 7, 2018 at 13:19 | comment | added | Tardis | @PerDigre, sure we can ;-) Indeed, matter is complex since e-Privacy Directive is lex specialis of the defunct 95 Directive on data protection. But the e-Privacy Directive and the coming e-Privacy Regulation are meant to protect privacy, and not only personal data. See: privacytrust.com/guidance/gdpr-vs-eprivacy-regulation.html Personally, until e-Privacy Regulation is adopted and other guidelines for cookies are issued, I would follow the mentioned WP29's Opinion. After all, it is the opinion of the data protection authorities of the EU about the e-Privacy Directive :-) | |
| Jun 7, 2018 at 9:44 | comment | added | Per Digre | @Tardis we are allowed to disagree ;-) You have very insightful information and you may be right. For the time being I don't think we have a definite answer. Blogs and websites hash on the question of what is considered personal data. GDPR clearly states person-identifying data. Example of one company's point of view, cookiebot.com/en/gdpr-cookies/… | |
| Jun 6, 2018 at 13:46 | history | edited | Tardis | CC BY-SA 4.0 |
typo
|
| Jun 6, 2018 at 13:36 | history | edited | Tardis | CC BY-SA 4.0 |
Reference to ePrivacy Directive and future expected ePrivacy Regulation
|
| Jun 6, 2018 at 8:38 | comment | added | Tardis | @PerDigre, again, I disagree. The cookies allow the server to single-out a user, and yes, you can perfectly program your site to request consent before a cookie is set when such consent is needed. Whether you know the identity of the user of the browser or not is irrelevant: you are still processing data concerning the user's navigation in a way that allows to single-out that user, and that is a personal data processing. Depending on the purpose of the collection and the type of cookie, consent will be required or not, and that is when WP29 Opinion on Cookie Consent Exemption is useful. | |
| Jun 4, 2018 at 18:13 | comment | added | Per Digre | Tardis, both the opinion documents you are referring to specifies "personal" and "user" information. The first document mentions third party advertising as non-exempt, but it is my understanding that browsing-context when you are not logging to a specific user, does not fall under personal data. It is most definitely a point of argument the third party advertising will use for years to come. | |
| Jun 4, 2018 at 17:53 | comment | added | Per Digre | @Manngo, GDPR is only about personal data. The cookies are linked to the browser, they do not necessarily know who the browser belongs to. You cannot ask for consent if you have no person to register the consent to. It is the same reason Google can present advertising based on searchwords from the session without asking consent. Also Hotels.com can present advertising based on previous searches (using domain cookies) without asking consent. | |
| Jun 4, 2018 at 10:56 | vote | accept | Manngo | ||
| Jun 3, 2018 at 18:36 | comment | added | Tardis | @Manngo, I fixed the link, sorry for that These documents do pre-date the GDPR, and were adopted at the time the 95 Directive was in force, but the work done by G29 and their recommendations is not incompatible with the GDPR's provisions, and should apply today, until (and if) other guidelines are adopted. | |
| Jun 3, 2018 at 15:27 | comment | added | Tardis | @PerDigre, I disagree. The search words are linked to the user of the browser. | |
| Jun 3, 2018 at 15:21 | history | edited | Tardis | CC BY-SA 4.0 |
fixing link
|
| May 31, 2018 at 22:23 | comment | added | Manngo | This answer looks very promising. I am having trouble with the link on providing guidance on obtaining consent for cookies.. Is it this one: ec.europa.eu/justice/article-29/documentation/… ? Also, the documents predate the GDPR requirement — are they current? | |
| May 31, 2018 at 18:43 | comment | added | Per Digre | Also, if the cookie does not contain information identifying a person it would not be subject to GDPR's privacy regulation. Example, if hotels.com leaves a cookie remembering search words then it would be ok to later present advertising based on those serach words. | |
| May 31, 2018 at 8:59 | history | answered | Tardis | CC BY-SA 4.0 |