“Do Not Track” is a legally binding order, German Court tells LinkedIn::Landgericht Berlin gibt Klage des vzbv gegen die LinkedIn Ireland Unlimited Company weitgehend statt
Oh, I hope this goes to higher courts and cascades down to be an alternative to the stupid cookie banners.
Also, what exactly are “essential cookies”? Why does the website get to decide if they are essential?
Every request your browser makes to a website is like the first time that website has ever seen you. Each image, content request, etc. All from somebody completely new and unknown[1].
The only way a website can identify you as a user is to ask your browser to store a unique ID (generated by the website) that you can then present with each request. This is a ‘cookie’. It gives you a temporary identifier that can be used to recognize later requests as coming from the same person.
Without a cookie you couldn’t login to any sites. Even if you’re not logging in, without a cookie the website couldn’t remember what your language preferences were (important in Quebec or other government sites), or timezone, etc. It couldn’t even remember that you wanted to reject all “non-essential” cookies and would prompt you on every page request. Every single request would be from an unknown person visiting the site for the first time.
[1] Yes, I’ve simplified some with keep-alive etc.
Just to add up, the “session” cookie is a special case for the browser which identifies them as such, and handles them as temporary because usually it expires in a few hours. Also, they must have an expiration, and it clears them as soon as you close your browsing session no matter if they expired or not.
To be fair, some websites do need certain cookies to function correctly. As a random example, if a user goes to their bank’s website, they’re more than likely not going to know what to enable/disable cookie wise so that the website is still functional for logging into their account. So I can understand lumping those actual essential cookies into one category in those instances. However, I agree that it’s almost certainly being abused.
Probably worth noting: Only things like non essential third party cookies need consent. Essential cookies for things like the users active session that are not shared don’t need a cookie banner.
Source: gdpr.eu/cookies
Meanwhile the “Remember Me” checkbox only works on maybe half of the websites I use.
I don’t mind “essential cookies”. Otherwise I would just configure my browser to not accept them at all.
But what really interests me is what “legitimate interests” are.
But in the end it’s not about the cookies, it’s about the tracking. The technique is irrelevant.
First off, INAL, and my data protection training pre-dates the GDPR.
Things like security, fraud prevention, but also direct marketing. In the sense of a shop you already bought something at sending you an email “hey we’ve got a new shipment and you bought these teas before so we think you might like this one”. The last one has to be opt-out, and indeed be direct, they can’t do “hey check out our parter stores and have you heard of Raid Shadow Legends”. Essential in that context would only be processing information strictly necessary to fulfil the contract, which would be more restrictive than IRL (where your tea guy indeed does remember what you like).
The data you collect has to be necessary for that legitimate interest, and you have to balance it against the consumer’s right to privacy. In a nutshell: If someone would complain, or someone reasonable (legal term :) wouldn’t expect you to use the data in the way you do, better get a lawyer.
Meta tried to argue that it covers all the tracking and all the advertisement they want to do “because we have a legitimate interest to earn money and the user wants a service and privacy doesn’t matter”, they ran against a brick wall with that one. Legitimate marketing in their case would be to tell you about their other platforms.
The cookie which stores the “Do Not Track” request is pretty essential don’t you think? Cookies is just what we call a particular websites local device cache. You can store whatever you want in there but they are best used for user settings, what user configurable theme should the site use, maybe you have a login token in there. Essential cookies (cache) the site needs to function properly.
Cache isn’t scary, it’s the tracking info and other related data they use to sell you ads.
There are certain things you are allowed to use cookies for even without asking for permission (i.e. they wouldn’t even need to tell you about them). These are effectively the kinds of things that are necessary for your website to work in the first place: For instance if you have a dark and a light mode and you want people to change this even without logging in, another example is language settings (this is why sites like e.g. duckduckgo can have a “settings” tab despite the fact you are not logged into anything).
The rule-of-thumb is that everything that is directly related to the functionality of your website is fair even without asking (they are “essential”).
Of course the specifics are a little more tricky: For instance you could have a shop in which you can put things into your “shopping basket” without being logged in. This is fine since it’s core functionality. However, if you use that same cookie to also inform your recommendation algorithm, you could get into trouble. Another aspect is 3rd party cookies: These, while not theoretically always requiring permissions, in practice do need expressed permission since you, as the website host, cannot guarantee what happens with these cookies (and 3rd party cookies are, in general, an easy way to track users, which isn’t core functionality for most websites).
Thank you for the thorough response. Personally, I would like to reject absolutely everything and then have the website tell me which functionality won’t work without a cookie as I try to use it.
