0

I use cookie in my site for login management. I user logs in the cookie dies with the sessione, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I store a hashed informations (user_id,password_hash). It's used to check if user is still logged in in a new session and I use these informations to check if user can access site without relogin. I read in some article about GDPR that technical cookies are allowed without any disclaimer. I can consider my login cookie a technical cookie since I store only these informations? I need to show the disclaimer in this case? Thanks in advance

1

From the WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194:

Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be immediately aware of the fact that closing the browser will not clear their authentication settings. They may return to the website under the assumption that they are anonymous whilst in fact they are still logged in to the service. The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case.

So a cookie to keep a user logged in, requires consent. But the checkbox "Keep me logged in" is appropriate to gain consent. So in your case you do not need to display a cookie banner.

  • See also this answer for more details about other kinds of cookies which don't require consent. – wimh Oct 1 '18 at 12:23
  • So it's enough the string "Keep me logged in" or i must write "Keep me logged in (this uses cookies)" ? – Golber Oct 1 '18 at 13:32
  • The WP29 text includes "uses cookies", as they are the experts, it is probably better to do that. – wimh Oct 1 '18 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.