It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking.
I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them.
All in all, it's pretty sad.
Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
Functional cookies like this are exempt from GDPR's opt-in requirement
* user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases
* authentication cookies, to identify the user once he has logged in, for the duration of a session
* user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration
* multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session
* load‑balancing cookies, for the duration of session
* user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer)
* third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.
This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent.
[1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Nobody knows how EU DPRs will define "need" and therefore, to be safe, you just always show the warning. The cost of the warning is low. The cost of being found in violation is high.
Avoiding this sort of outcome is basic stuff, law-making 101, but the EU's output of low quality rule-by-law not rule-of-law regulations makes it seem like they either don't know or don't care.
That isn't the claim. The claim is that a bunch of cookies are specifically exempt from the law and the law tells you that you don't need to put up cookie banner click-throughs. And also that everyone ignores that, and puts up the banner click-throughs anyway and then moans about EU law.
> 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
You never need both. GDPR superceded the "Cookie Law", so the cookie policy pop-up is no longer needed. You may not even need the explicit consent popup.
You do need user consent for storing user personal data, if you gather, store, and process personal data. Even then, you only need explicit consent if none of the other implicit authorizations apply: https://gdpr-info.eu/art-6-gdpr/
With a UI that deliberately makes it very cumbersome to opt out and very easy to opt-in with no obvious way (aside from clearing all browser cookies) to later change your mind...
> (required by EU law)
Contrary to what the sites imply, the pop-up is not required by law (I'm guessing you, sshine, are well aware of this, but the general public aren't). It could easily be an in-page (rather than over-page) or interstitial page politely requesting that we agree to the cookies being stored on later page views.
The request to opt-in is required by the law. The pop-up is required by the site's desire to make it inconvenient for you not to.
> (required by EU law)
While we are on the subject of the law: the way many sites implement the consent walls is not compliant anyway. A common issue is storing data in tracking cookies until opt-out rather than not storing it until opt-in. The other common flaw is one is mis-classification of stored content: should that cookie for doubleclick.net really be classed as "essential for site operation"?!
> in Firefox at least no cookies are shared between public/private
That is also the case for incognito/private/what-ever-they-brand-it mode in Chrom{e|ium}, IE, Edge, and I assume (though I haven't tested this myself at all) Safari and others too.
Though there are some clues that can leak from normal to private due to known bugs & edge cases in the browsers and common add-ons (like flash), search for "evercookie" to find some references about that, and there are other ways to fingerprint or track you which might be less reliable but still apparently work well enough for people to use them.
That is both not required. Just don't collect PII and all is good. Apple for instance manages to run a website that does not involve any stupid cookie warnings.
https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-...
Not always required by EU law, but always always blamed on EU law.
> 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
Not always required by EU, but always always blamed on EU law.
Because I can't see the CookieBot pop up anymore I can't dismiss, but it prevents scrolling from working on a large number of websites.... All news websites interestingly enough.
We need a combined Decrap extension that kills all this crap and presents a clean browsing experience on a fresh browser.
The consent might be asked when you navigate to next article within the website, but majority of people don't.
1. A pop-up notifying the visitor on the website's cookie policy (required by EU law).
2. A pop-up asking the visitor to consent to its privacy policy (required by EU law).
3. A pop-up asking the visitor if they'd like to subscribe to its newsletter.
4. A pop-up telling the visitor that it's run out of "free articles", but that you can sign up at a premium.
5. A pop-up asking the visitor to turn off the adblocker because the site's revenue depends on the ads.
6. A pop-up asking the visitor to participate in an online survey.
7. A pop-up telling the visitor about a unique way to earn money in your underwear.
None of the pop-ups will share UI for closing them, and some of the close buttons will be so hard to press that you accidentally change site instead.
(Clarification: It doesn't have to be a pop-up, but it does have to be annoying.)