If the GDPR applies, then the e-privacy directive (EPD) (formally Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002) almost surely also applies. However, this being a directive rather than a regulation, the implement6ing laws may vary in different countries.
The relevant provision is Article 5 paragraph (3) which reads:
Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia [among others] about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
This governs cookies and any other local data, that is, data stored on or read from the user's equipment.
What this means is:
- A site operator must disclose, in detail, what cookies or other local data the site stores on or reads from the user's device. Even strictly required data (cookies) must be disclosed.
- A site may not store or read any local data until after consent has been obtained. The user must have the option to consent to or refuse consent to individual data items separately. Giving consent may not be a condition of permission to use the site. Consent must be opt-in, not opt-out, that is the default must be "No consent".
- Local data (including cookies) that is "strictly necessary" for the operation of the site is exempt from the requirement of consent, but not from the requirement of disclosure, and that means specific disclosure.
- It must be at least as easy to cancel consent later as it was to give consent initially.
- Do my Stripe cookies count as essential cookies?
- If the Stripe cookies count as essential, is it legal to provide no option to turn them off?
- Have I met my legal requirements in terms of disclosure? The terms and conditions and privacy policy were generated by Termly.
- I don't know stripe well enough to be sure, but they might. What do they do that is essential for operating the site?
- Yes.
- No, not if the disclosures in the question are the only ones you make. As I understand it, you must provide at least a link to a page that shows each specific cookie that you read or set, and what data is stored in that cookie, even for strictly required cookies.
Update:
I should mention t6hat although the above describes my understanding of the current legal requirements, I have read that enforcement of those requirements does not seem to be a priority for the relevant authorities at this time. Other aspects of data protection, such as proper security to avoid data breaches, and having a proper legal basis for processing, and other GDPR requirements, as opposed to e-Privacy requirements, seem to get more attention and resources from the relevant authorities.
Having read the comment by the OP, it does seem that at least some of the stripe cookies are strictly required and need not have consent.
The stripe cookie policy linked to is better than many sites currently offer. It does not go into fully specific detail, but it may be that the dashboard does, and that together the two are fully compliant. Linking to this policy (and if possible directly to the stripe cookie dashboard) would seem to me to cover most of the issues here.
