A lot of googling didn't help me with the following questions:

Given I own a website which only creates one cookie that identifies a users session - is it okay to embed said website in an iframe without prior consent? Accessing the webpage in a logged-out state does not create a cookie, but being logged in makes the value accessible to the websites server / javascript that is loaded in the iframe.

Furthermore: given an identifier that is added as a parameter to my webpages url that identifies the embedding page (e.g. www.asd.com embeds my page www.mypage.com with ?id=35235) - is that GDPR compliant or not?

  • GDPR has nothing to do with cookies unless they contain personal data. There is a separate EU law about cookies. – Dale M Sep 30 '19 at 23:48
  • How does this hold up to eprivacy then? There also was a ruling today in the europe supreme court that declared all cookies no matter the content opt in. Session identifiers are not personal data right? – roookeee Oct 1 '19 at 16:11
  • as I say, cookies with personal data are subject to GDPR and those without are not. However, all cookies are subject to the cookie law which is a different law than GDPR. – Dale M Oct 1 '19 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.