3

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't?

For example:

Website uses cookies

Improve this question
  • 4
    I think in at least some cases this is related to a law that was passed in the EU that required sites to disclose to the user that they used cookies for certain purposes, for example third party advertising. (Cookies for purposes of session management and such were exempt). – puzzlepalace Apr 22 '16 at 22:58
  • 8
    This is due to an EU law, as answered in greater detail over on UX.SE. – WBT Apr 22 '16 at 23:02
  • 1
    The comments already answer the question; I voted to close as not security-related. – Tobi Nary Apr 22 '16 at 23:58
6

The reason you see that message is Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, according to which users have to give consent for the storing of information (read cookies) or retrieval of information already stored.

Some cookies are exempt from this rule, namely when the cookie

  • is needed for carrying your data over the network, or
  • required for the (requested) service to operate properly.

Or in legal jargon, when the cookie

  • is used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or
  • strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

Directive 2009/136/EC, Article 5(3):
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

Directive 2002/58/EC, Article 5(3):
Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

The interested reader can also take a look at the Opinion 04/2012 on Cookie Consent Exemption document.

Note that a directive is not a law. "A 'directive' is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to devise their own laws on how to reach these goals."

Improve this answer
  • 1
    I wrote to somebody about the popups and this was the reply: "Please note that the GDPR does not require the information that must be delivered to a site visitor to be presented in a pop-up. Contact the website administrator if you are not satisfied with their design choices.". So this means that websites could have presented it in any other way too, without annoying people with a popup. – Nav Sep 15 '20 at 10:50
  • 1
    @Nav -- I've seen the use of (i) modal windows where the main window is blocked until the use of cookies is accepted, but also cases where we get a (ii) simple banner that allows the use of the website even if we don't accept cookies immediately, or even an (iii) android-like toast that shows for a few seconds and disappears on its own. I don't know of other ways the information is presented. – Daniel Sep 16 '20 at 12:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.