3

With the GDPR regulation that requires getting consent from EU users to accept the use of cookies, where should non-consenting users be sent?

There seems to be quite a few options but what are the pros-and-cons of each?

  • Google
  • GDPR regulation page.
  • Random website somewhere.
  • Error page saying something like "Error: Cookies required to operate".
  • Blank page on the site being visited.
  • Truly blank page: about:blank
  • Just keep the cookie consent form above content.
  • Other option not listed above.
  • If you setup GDPR correctly, your site should work without cookies. – Simon Hayter Jul 3 '18 at 11:16
  • @SimonHayter - Actually most of mine do but a few ad-revenue properties use AdSense and were asked by Google to handle the issue. – Itai Jul 3 '18 at 13:34
  • With regards to targeted advertising cookies, it would usually be preferable to not display the "targeted/tracked" advert, rather than deny access to all content. – DocRoot Jul 4 '18 at 20:03
  • Not sure there is a way for the site to opt-out on the behalf of the ads to be targeted and I think a cookie is still used to remember that a user opted out. – Itai Jul 4 '18 at 20:28
1

Should non-consenting visitors be kicked out

It depends on the use of the cookie, as this ICO page says:

An online furniture store requires customers to consent to their details being shared with other homeware stores as part of the checkout process. The store is making consent a condition of sale – but sharing the data with other stores is not necessary for that sale, so consent is not freely given and is not valid. The store could ask customers to consent to passing their data to named third parties but it must allow them a free choice to opt in or out.

This seems to imply that if the consent is not needed for a primary purpose of the transaction, it cannot be a requirement of the transaction, although as the GDPR is still quite new I am unaware of any cases that have decided on the definition of required for this.

Thoughts on the options proposed

  • Google

    Some users avoid using google because they do not want to be tracked, hijacking their browser and taking them there seems like a bad option.

  • GDPR regulation page.

    Unless they click a button/link that says something like find out more about the GDPR it is unlikely they want to know more.

  • Random website somewhere.

    This would cover any site, so it is quite general

  • Error page saying something like "Error: Cookies required to operate".

    This seems like a good option, it can explain why cookies are needed, what they do, and allow for granular cookie options/

  • Blank page on the site being visited.

    If the page is truely blank this will probably annoy the user and make them think the website is broken, leading them to go elsewhere.

  • Truly blank page: about:blank

    See Blank page on the site being visited., except without the page header

  • Just keep the cookie consent form above content.

    This would require you to not set cookies until you can be sure the user has clicked accept

Overall

The best option is a page that explains why you want to set cookies, what the cookies will do, and allows them the option of opting in to cookies.

If you have alternative channels, it may make sense to list them here too, so for a Hotel you could include a booking number if the user prefers to book over the phone rather than accepting the cookies.

  • Nice complete answer! – Itai Jul 4 '18 at 1:37
0

Depends on the site, and the cookie use. I have a site where you have to agree that you are over 18, if you don't except the cookie it will stop them there, if they awnser no, then I send them off to google after a notice to them they must be over 18 to enter. The session cookie (via php) is needed too. So either they agree to my terms and conditions, accept the cookies, or go somewhere else.

Btw, the site will not work with cookies disabled, and legally, they must tell me they are over 18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.