Re:First complaints under the GDPR lodged within hours
by hyperman1 on Saturday June 09, 2018 @09:18AM
(#17272873)
AFAIK,the 'cookie law' directive was even more relaxed than what you describe. It never mentioned cookies explicitly. It was talking about tracking. If you had a good technical reason like keeping login session open, you never had to place a pop up in the first place.
However, if you started to track people explicitly, even without a cookie, you needed to inform the user.
How that law got interpreted as a 'put a pop up on everything' is beyond me. Most sites managed to annoy the user with a pop up, and still were not on the legal side of the law as they did not inform which third parties exactly got the information.
Why didn't the EU step up and gave guidance to stop the madness? No idea. In general, they tend to bury you alive under folders when given half a chance.
I don't know what the cookie law status is today. It was supposed to be superseded by the GDPR, but i think it is still active, together with the GDPR.
However reading cookies (and sending the content to a server) obviously is privacy sensitive, although even then it should be noted that users have full control over the cookies. This makes cookies better than e.g. a profile that's stored on Facebook's servers.