Re:Google Chrome browser privacy plan investigated in UK
by pdpi on Friday January 08, 2021 @08:58AM
(#25684750)
There are no cookie policies in the EU. What we do have is a policy around personal data and identifying users, and cookies are mentioned in passing as a particular way this is achieved in practice.
[ Parent
| on HN ]
Re:Google Chrome browser privacy plan investigated in UK
by lmkg on Friday January 08, 2021 @09:12AM
(#25684879)
There are cookie policies in the EU. GDPR covers personal data, of which cookies can be one particular way. The ePrivacy Directive is a separate law, modified but not repealed by GDPR, which addresses cookie data. The difference and interaction between those two laws ends up being extremely significant.
Re:Google Chrome browser privacy plan investigated in UK
by pdpi on Friday January 08, 2021 @09:22AM
(#25684956)
Every single instance of the word "cookie" in the ePrivacy Directive[1] is qualified with either a "for instance" or with "or similar devices".
1. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
Re:Google Chrome browser privacy plan investigated in UK
by lmkg on Friday January 08, 2021 @09:46AM
(#25685200)
My point is that cookies have additional regulations beyond just being personal data covered by GDPR. You are correct that cookie-equivalents are similarly regulated (including most fingerprinting techniques!). But they're not just a special case of GDPR.
Most importantly, the ePD applies to cookies even when they are not personal data. Your post made it sound like the only concern is identifying users via cookies. That is not the case. Non-identifying cookies would not incur obligations under GDPR, but they do incur obligations under the ePD.