2

I am pretty new to the idea of asking for consent for storage for a website because I'm American. I understand that if I want to store anything, I need to ask users for consent.

However, I'm confused by exactly how to abide by the Cookie Law. How do I know if the user has agreed to storage if I can't check the storage? Is it more that I am allowed to check local storage to to see if the user has agreed previously? ie I don't store anything until the user agrees, but I may check local storage to see if the user has agreed to anything.

I might be digressing, but the way I interpret the law was that if I track anything that can give insight into who the user is, that's bad. But if it's used for a purely frontend application for the website (eg a personal blog that may have a search backend, but the storage items aren't used for that), I don't have to worry so much? Esp if it's storage for things like color modes or positioning of navbar (left, right, up, down)?

I guess what I'm getting at is what's a reasonable flow to be compliant at the same time as leveraging cookies so the site doesn't reset to vanilla and consent banner doesn't pop up every time the user visits?

6
  • 2
    Does this answer your question? Do the GDPR and Cookie-Law regulations apply to localStorage? Sep 16 at 3:42
  • I'm still a bit unclear on whether color and positioning fall under technical per se, but I think based on their examples they're somewhat acceptable. However, I still don't understand if I'm simply allowed to check local storage without consent to check for consent 🤔 That llink and others I searched up don't answer this bit.
    – shanshine
    Sep 16 at 4:02
  • 1
    Cookies and LocalStorage are legally equivalent. The actual criterion for not requiring consent isn't "technical" but "strictly necessary for providing a service explicitly requested" by the user. It doesn't matter what kind of data is stored (doesn't matter whether it enables tracking). If the user switches the color theme, it is strictly necessary to remember that choice across page loads. It is also strictly necessary to honour consent status, which means you might have to check whether a consent cookie already exists – showing a consent banner each time might even be illegal nagging.
    – amon
    Sep 16 at 6:51
  • The linked question is similar, but this asks abour=t reads before asking for consent which is not really covered in the other question. Sep 16 at 23:06
  • @DavidSiegel the linked question says you don't need consent all the time?
    – user253751
    Sep 17 at 10:01
3

Yes, a site may check for a cookie indicating past consent before prompting for consent to read and store cookies

When people speak of the "Cookie law" they usually mean the ePrivacy Directive, (ePD) more formally the Privacy and Electronic Communications Directive 2002/58/EC. The full text of the directive is here

First of all, being a directive and not a regulation, the ePD is not itself legally binding. Instead it instructs the legislatures of member states to implement it, which they generally have done. So the actual binding law is the law of a particular country, which could vary from the wording of the directive. However, in this case, my understanding is that the implementations do not vary significantly. An updated and revised ePrivacy Regulation (ePR) has been proposed, which would replace the ePD and complement the GDPR. But there has been dispute over the proposed terms of the ePR, and it has not yet been passed.

Article 5 section (3) of the ePD reads:

  1. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

Notice that this covers both writing (storing) and reading (gaining access to) cookies and other information stored on a user's device. Cookies ar one form of such locally stored information (LSI).

Note that the GDPR, which replaces Directive 95/46/EC, is used to define "consent" in the ePD.

In general, one must have consent to read or store, and consent must be sought only when the user has been given "clear and comprehensive information ... about the purpose" of the stored information. The relevant exception for this question is that information (including cookies) which is "strictly necessary" to provide a service specifically requested by the user.

Here the user has requested access to the web site, and may have previously agreed to accept cookies. The site must prompt for consent if the user has not previously consented (and the site will store cookies not strictly needed), and should not if the user has. Therefore, it is strictly necessary to check for and read if present a cookie indicating that such consent has previously been granted. If such a cookie is not found, no consent has been granted.

Strictly required LSI should not have a dual purpose where one purpose is not strictly needed. For example, an "I accept cookies" cookie should not also be used for tracking. That should be done (if at all) with a separate cookie, and only after consent is received.

Note that there should be an easily found and easily used method or link on the site (preferably on each page of the site) to review the purposes of stored or accessed LSI, and to withdraw previous consent. If consent is withdrawn, the cookie indicating that consent has been granted should be erased, as should any cookies or other LSI not strictly needed to provide the services requested by the user.

Keep in mind that the legal distinction is not between cookies that contain "technical" information and those that do not. That is not relevant. Nor is the distinction between cookies that might be used to identify a person and those that do not. The legal distinction is between cookies (or other LSI) that are strictly needed to provide the services requested by the user, and all other LSI. Strictly needed LSI does not require consent, all other LSI does.

For example, a random string, used to determine the number of unique visitors, but not linked to any identifying info about the user, does not help to identify an individual user. But it is not strictly needed, so it can only be stored with consent.

Data that are associated with an identifiable natural person (human being, not a firm or organization), are governed by the GDPR (where it applies). There must be a lawful basis for processing such data, which includes reading them from LSI, and storing them. Consent is one of the six possible bases for such processing, but consent need not be obtained if another lawful basis applies. When consent is the basis, it must be easily withdrawn by the user. Note that this applies to all data (PI) that is associated with a person, not just data that can readily be used to identify the person (PII).

Note that other workflows are also lawful. For one example, if a site is a strictly membership site, it could prompt for a login before reading or storing any LSI, and then read previous preferences stored on the server by that user to determine whether consent for cookies has been granted.

Conclusion

A cookie indicating that consent to access and store cookies hs previously been given by a particular user can lawfully be read before a user is prompted for consent, under the ePD and its implementing laws.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.