I thought GDPR cared mostly about uniquely identifying visitors which this does not do. You still need a cookie banner to state that you will put some data on their machine but you always need one of those.
Thanks for this! I'm at a point where I am way more annoyed by cookie banners all over the place than whatever tracking is being done on me that I almost wanted to go back in time before GDPR, now I don't have to :)
I am not a lawyer or a GDPR expert, but I think that probably wouldn't satisfy the intent of the GDPR any more than current browser capabilities to accept or reject third-party cookies would.
If it’s anonymous and doesn’t collect any user data, why do we need it at all? Would using a cookie for the same purpose (just a counter of visits, resetting every day) trigger the GDPR laws somehow? It would work in literally same way except being transparent to the user instead of utilizing some shady technique.
I agree with you. It's privacy friendly to have a cookie stored on the browser with a boolean only. Unfortunately it's not allowed by GDPR without asking for consent first. Would be open to other ways without cookies and fingerprinting. I think there is no other way.
This is pretty much how it's supposed to work under GDPR. Offering a clear choice without bias. GDPR isn't about banning cookies. It's about giving the user control of their data.
GDPR doesn't care if you're accomplishing the tracking with a cookie or using a different mechanism. You're not allowed to do it either way, unless the user has consented.
That's the problem with the GDPR. Excellent idea, but badly executed. Something like the DNT-Header should have been in the law, saying that the user only wants the really necessary cookies.
A cookie used solely for counting anonymous visits without storing individual identifiers generally wouldn't be considered personally identifiable information under GDPR.
At least that's what I was told. Having said that, this is obviously a complicated and nuanced topic with a lot of grey areas. I guess it's a good idea to talk to a lawyer in any case.
Not this again. GDPR references cookies only once, along with IP addresses and other things, as examples of things that can be used to identify people. It made no law on how all of those things should be handled.
It was the ePrivacy Directive that actually regulated cookie use.
reply