Do I really need this window popup on my website if I am not explicitly setting any of the cookies?
I have a website that uses maybe 2 outside scripts and they do set few cookies but on their domain not on my website. And I am not setting any cookies on my domain name for the user's browser.
I have a subscribe button but it doesn't have anything to do with cookies, I just save the mail you supply to database.
Your website, your responsibility. If you cause your website to load content from third parties or to set cookies, it is your responsibility to make sure that all of this happens legally. If those cookies are not strictly necessary for providing a service explicitly requested by the user, it is your responsibility to ensure that valid consent has been obtained first.
The relevant case law in this matter is the Fashion ID case that was brought before the ECJ. A website had embedded a Facebook Like button. The website argued that it was not responsible for data collected through this embedded content – that they had no control over those scripts, and thus no responsibility. The court found this to be mostly false. The website operator did have control over whether or not to embed the third party content, and was a “joint controller” with Facebook with regards to the data being collected and shared via the Like button. Already the loading of a resource shares personal data such as IP addresses. However, the website operator cannot be responsible for whatever Facebook subsequently does with the collected data on their servers.
For you, this means:
If you embed third party content (whether images, frames, or scripts) this constitutes sharing of personal data with a third party. Figure out why this sharing is necessary and obtain a valid legal basis. Potentially, the only appropriate legal basis is consent, in which case you cannot load the third party content until consent was given. Alternatively, the third party might be prepared to act as your data processor so that the third party will not use the data for their own purposes, but this requires a suitable contract.
If you cause your website to execute scripts that in turn set cookies, you are jointly responsible for ensuring compliance with regards to cookie consent. Strictly necessary cookies do not require consent. Sometimes the third party handles consent. But since you are ultimately responsible, you might want to handle cookie consent yourself.
You are drawing the distinction based on the domain on which cookies are set. The “cookie law” (the ePrivacy directive) does not make this distinction, and isn't even specifically about cookies. It covers accessing or storing of information on the user's device of which cookies are a specific case. There is hope that in the future, an ePrivacy reform will add some exemptions for first-party cookies. But no such reform has been passed, and some member state's laws to that effect are likely in breach of EU law.
