should a website show cookies popup in following context?

Question

I am a part of developers team in a software as service project hosted and HQ-ed in United States.

Why I asking my question

I personally tasked to improve our analytics and one of tasks is to find an alternative or develop in-house solution to be used instead of Google Analytics.

Main expected requirements are:

1. be able to gather aggregated analytics data scoped only to our website, like visitors total count and by referrer websites, pages popularity, and like/dislike ratings overall (users able to set these ratings on our blog posts, FAQ, etc.),
2. and e-commerce-related events for aggregated subscriptions, purchases and payments attribution to campaigns, affiliates, referrals, etc.) to be shown at a dashboard.

Context

Implementation aspects in question: There is an option to use a special first-party cookie with sliding expiration like 4-8 hours, generated on our servers in case of its absence, so this is not a permanent device id or something bound to a user, his/her IP address or location. This cookie will have strictly set sliding lifetime adjusted to last time of interaction with website. This analytics cookie is a separate from auth (session cookie) whose sole purpose to remember signed in user if user signed in.

Question

Should our website show a popup about cookies in this setup, and if so, what is should be stated there in accordance with latest GDPR, ePrivacy Initiative, UK PECR and CCPA?

Answer 1

Such a first party cookie is not "strictly necessary" for the operation of the site, and so if the site is to be used where the EU e-privacy directive is in force (more or less the same situations that would make the GDPR apply) consent must be obtained from the user before any such cookie is read from or saved to the user's device. (the same applies to any other locally stored data.)

A standard way to do this is to ask for general consent for all cookies, with a broad general description of the purposes for whch cookies will be used, plus a link to a page or pop-up that gives specific information about each cookie that may be used and its purpose, and allows specific yes/no consent for each such cookie.

Other structures may be used, but there must be some fairly easy method for a user to learn what cookies will be read or written, and what their individual purposes are, and to grant or withhold consent on an individual basis.

The directive does not mandate the interface to be used, only that the information must be available to the user, and consent must be obtained before any cookie is read or set, except for "strictly necessary" ones. Those do not need consent. Consent must be "freely given" as defined by the GDPR, which means no pre-selected answers, and consent cannot be a condition for use of the site.