I have a website that uses cookies only if the user logs in. Is it necessary to show a cookie popup banner at website launch or can I ask for consent when user is creating an account (the standard I agree to the website conditions checkbox)?
1
-
1Keep in mind that it's only of serious importance if you're located inside the EU or take payments from EU users: law.stackexchange.com/questions/81602/…– JonathanReezJul 20 at 21:09
Add a comment
|
1 Answer
Under European rules (GDPR, ePrivacy), you only need consent here if you both
- access or store information on the user's device (such as cookies), and
- this access/storage is not strictly necessary for a service explicitly requested by the user.
A session cookie is strictly necessary for providing a log-in functionality, so such cookies are unlikely to require consent. In contrast, cookies for measuring ad impressions are not strictly necessary for showing the website content. Necessity must always be thought from the user's perspective, not from the provider's economic needs.
If you use one cookie for multiple purposes, you should analyze each purpose separately. Maybe setting a cookie does not require consent under one purpose, but accessing the same information for a different purpose could require consent.
If you have to ask for consent, this consent must be in line with the GDPR's requirements in Art 7. Consent must be freely given, i.e. there must actually be a way to decline the consent without suffering detriment. Consent must be informed, i.e. the user must be told directly for what consent is being sought, without having to click through to a long privacy policy. Consent must be specific, so it must be possible to consent for one purpose while declining consent for another.
An "I agree to the terms of service and privacy policy" checkbox cannot constitute valid GDPR consent because it fails all these criteria: I cannot use the service without agreeing, I'm not told essential information up front (you cannot expect users to actually read long privacy policies), and this is an all-or-nothing bundle that does not allow specific choices.
If you do not have to ask for consent, you should still be transparent about your use of cookies, for example by providing a paragraph on this topic in your privacy notice. I think showing a cookie banner would be a bad idea in that scenario, since it could be confused with an invalid consent banner (no way to decline the cookies).
