Common CMSs send cookies by default. Even if you are one of those tech-inclined people using a static site generator for your own website, this is not the case for millions and millions of other websites.

Then let's replace those CMS's.

[edited with less anger]

Replace them? You need cookies for a tonne of reasons. It's really difficult to justify replacing half the web because some people abuse it. That's like replacing cars with walking because some people drink drive.

What reasons do you need the types of cookies you need to ask permission for under the GDPR?

*sigh*

Here we go again.

The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should.

The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.

> I don't send cookies or keep personal data, so why do I need to worry about them?

Can you share your website/service?

Commenting to follow up later. I'm really interested in the use case. The only thing I can think of would be a website similar to mid-2000s youtube to mp3 converters.

Alas they are all behind ssl authentication so you wouldn't be able to access them, but the stuff I currently have open includes a switch port mapper (every 20 minutes all my switches are scanned and reports generated on what's plugged in where), a firewall config interpretor (a list of current port forwards is generated), and a logging server showing me what

But if you want an example of a fully featured public site which doesn't need cookies

https://news.ycombinator.com/

Load that in lynx, which asks for every cookie, and none are set.

Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you.

Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.

> Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.

I am not convinced this is true. See: https://law.stackexchange.com/a/32157

Also note that HN is likely in violation of this since there is no "Remember Me" checkbox when logging in. There is no indication that logins will be persistent.