Skip to main content
38 votes
Accepted

What should a website do if the end user refuses to accept the necessary cookies?

These kinds of cookie banners are typically noncompliant and useless since they are not clear and provide too little information to users. Careful: blocking a user who declines consent is usually a ...
amon's user avatar
  • 24k
14 votes
Accepted

Can a website Demand acceptance of non-essential cookies to allow free access?

Your title is not necessarily consistent with your example. Can a website demand acceptance of non-essential cookies to allow access? As you have found, GDPR prohibits conditioning the provision of ...
xngtng's user avatar
  • 6,128
14 votes

What should a website do if the end user refuses to accept the necessary cookies?

It's very easy for a web site to claim they "need" cookies, with the same sincerity that a child "needs" a pony. So here is a litmus test. You say the user who comes to a URL ...
Harper - Reinstate Monica's user avatar
11 votes
Accepted

If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?

Under European rules (GDPR, ePrivacy), you only need consent here if you both access or store information on the user's device (such as cookies), and this access/storage is not strictly necessary for ...
amon's user avatar
  • 24k
7 votes

What should a website do if the end user refuses to accept the necessary cookies?

We can't answer what should be done. We can answer what legally can be done: There's a line in the sand between mainly two categories of cookies after doing the lawful basis tests: Strictly necessary ...
Trish's user avatar
  • 40.4k
7 votes
Accepted

Repercussions of defying the Cookie Law

european-union (germany, spain, uk) The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR ...
amon's user avatar
  • 24k
6 votes
Accepted

Should registered users accept cookie consent in GDPR?

Yes, you still need consent (opt-in). Cookies usually require consent, but not always. There are two relevant laws at play here: GDPR makes general rules about the processing of personal data, and ...
amon's user avatar
  • 24k
6 votes
Accepted

Is this Cookie scenario GDPR compliant?

There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) ...
amon's user avatar
  • 24k
5 votes
Accepted

Cookie Law: do anonymized analytics require cookie consent?

First of all, in a GDPR contest, the process described is not strong anonymization. It may be hard for an outsider to go from the stored record to any PII, it is much easier for an outsider to "...
David Siegel's user avatar
5 votes

Repercussions of defying the Cookie Law

gdpreuropean-union Bob could be fined (not sued) by supervising authorities (not users). Those fines can be hefty if the cookies contained PII (€20M or 4% of global revenue, whichever is higher), less ...
o.m.'s user avatar
  • 18.3k
4 votes
Accepted

May I publish source code of my project without notifications about use of personal data and cookies and not break laws during it?

I don't think you would be responsible for whether your software is used in a GDPR-compliant manner. For GDPR compliance, it is important who the data controller is. The data controller is whoever ...
amon's user avatar
  • 24k
3 votes
Accepted

Does GDPR require consent to collect non-personal information?

Does GDPR require consent to collect non-personal information? No. As long you process no data that meets the GDPR definition of personal information then the GDPR does not apply to you. The tricky ...
User65535's user avatar
  • 7,138
3 votes
Accepted

Is the creation of a cookie with a anonymous id a violation of GDPR even if it's not used until consent?

The cookie consent requirement comes from the ePrivacy Directive, not from the GDPR. While the GDPR defines consent, cookie consent is required regardless of whether the cookie actually contains ...
amon's user avatar
  • 24k
3 votes
Accepted

Do lax and lazy cookie messages comply with cookie laws?

The ePrivacy Directive Cookies are governed in the EU by the ePrivacy Directive which was first passed in 2002, and revised in 2009. However, if a site places a cookie, and later reads the cookie and ...
David Siegel's user avatar
3 votes
Accepted

Can you track those who denied tracking on a website?

I think you could count decline-events, but not track users who declined tracking. But I also think such information isn't useful for demonstrating compliance. Therefore, you should avoid storing ...
amon's user avatar
  • 24k
3 votes

Count visitor per day with GDPR & Cookies in EU

The question says: But by hashing a IP address you process the personal information and that you can't do without the user's permission! But processing personal data (PI) is covered not by the e-...
David Siegel's user avatar
3 votes
Accepted

Can you preemptively check local storage before user agrees under Cookie Law?

Yes, a site may check for a cookie indicating past consent before prompting for consent to read and store cookies When people speak of the "Cookie law" they usually mean the ePrivacy ...
David Siegel's user avatar
3 votes

Essential cookies - legal responsibilities

If the GDPR applies, then the e-privacy directive (EPD) (formally Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002) almost surely also applies. However, this being a ...
David Siegel's user avatar
2 votes
Accepted

should a website show cookies popup in following context?

Such a first party cookie is not "strictly necessary" for the operation of the site, and so if the site is to be used where the EU e-privacy directive is in force (more or less the same ...
David Siegel's user avatar
2 votes

Do sites need to explicitly ask for cookie consent as of 2022?

Yes, It Does The rules for cookies are not spelled out in the GDPR, but rather in the e-Privacy Directive (EPD), and in that Directive's implementation in national laws, those of EU members and of the ...
David Siegel's user avatar
2 votes

GDPR: Storing consent for non-personal data cookie

Cookies are information stored on the end users device and require consent¹ per the ePrivacy directive, even if the cookies or similar technologies don't contain personal data. Conditions for consent ...
amon's user avatar
  • 24k
2 votes

GDPR and Website Accept Cookies window

Your website, your responsibility. If you cause your website to load content from third parties or to set cookies, it is your responsibility to make sure that all of this happens legally. If those ...
amon's user avatar
  • 24k
2 votes

Cookie Consent: Do we require consent for login or user preferences?

The relevant law is the implementation in domestic law of the so-called ePrivacy Directive. In the united-kingdom the domestic law is Regulation 6 of The Privacy and Electronic Communications (EC ...
Lag's user avatar
  • 17.3k
2 votes
Accepted

Is there any chance of getting a penalty for cookies with no notification for a private person with small site?

It seems like you are overreacting: yes, private persons also have to comply with GDPR + ePrivacy. But fines must be proportional, and not all cookies require consent in the first place. The cookie ...
amon's user avatar
  • 24k
2 votes

Is consent required for paying, corporate subscribers of a B2B website?

Under the EU e-privacy directive, consent for cookies (and other local storage) is required except for "strictly necessary" data. Data used in part for analytics is generally not considered ...
David Siegel's user avatar
2 votes

GDPR cookie bar, auto accept when changing pages

No, that is not adequate for either the so-called 'cookie law' (the ePrivacy Directive, the law pertaining to storing data on the user's device) or GDPR (if the lawfulness of processing personal data ...
Lag's user avatar
  • 17.3k
1 vote

What should a website do if the end user refuses to accept the necessary cookies?

We're missing the obvious thing here. "Strictly necessary cookies" don't exist. Period. Every time - every single time- one of these banners pops up I use uBlock to zap it away without ...
Kyle's user avatar
  • 11
1 vote

Server side analytics events

I think your approach can be compliant, but it's going to be a bit tricky. Personal data has a broad definition The GUID is almost certainly personal data. Personal data is any information relating to ...
amon's user avatar
  • 24k
1 vote

Server side analytics events

It may not be possible to identify a GUID as being associated with a specific named natural poerson. But given information about a small number of specific individuals, it masy wel be possible to ...
David Siegel's user avatar
1 vote
Accepted

Does the ePrivacy directive apply to general JavaScript code?

Yes, the ePrivacy Directive is way more general than cookies. The translated Swedish law seems close to the original in the ePrivacy Directive: Member States shall ensure that the storing of ...
amon's user avatar
  • 24k

Only top scored, non community-wiki answers of a minimum length are eligible