4

I realized some types of cookie consent banners:

  1. a bar on the top or bottom of the page, with informations and options to select. The page remains interactive, user can browse menu and so on.
  2. a popup partly covering page, with informations and options to select. The page remains interactive, user can browse menu and so on.
  3. a popover fully covering page, with informations and options to select. The page remains so long not usable until user selects options and confirms selection. Then popover disappears.

In this relation i would like to know: are the both first and second solutions legally conform? If so, why some webmasters choose to use the third type?

Improve this question

2 Answers 2

Reset to default
1

Provided the site doesn't set any cookies, or at least only truly essential cookies before the visitor accepts or dismisses the cookie consent notice, then yes they are compliant.

Some site owners however really want to set all the tracking and marketing cookies, and so will go down the more full screen takeover route, hoping you'll just click accept all to get to the content.

Note that this isn't always to do with direct advertising: one site I've worked on recently for a new insurance product went down this route to ensure they were fully compliant with consent before visitors used their site.

Improve this answer
0

First you need to decide from which Countries your website will be accessible as the consent banner might need to comply to different legislations such as EU GDPR/ePrivacy, UK GDPR, CCPA/CPRA, LGPD, etc.

As per Recital 30 of the EU GDPR the cookie consent banner must prevent the website working until the user accept the way his personal data are collected and processed (See: https://gdpr-info.eu/recitals/no-30/).

According to the EU GDPR and the ePrivacy directive you may have exemption for some cookies which are "strictly necessary" such as authentication cookies. However, I don't believe this is applicable if you are using a third-party authentication service as you may need to transfer personal data to another entity.

You cannot find an unique answer to your question because, legislations may differ and it is very hard to find someone with competence regarding legistaltion across all relevant countries.

After this you need to find and work with a solicitor/law firm specialised in Privacy for all those Countries your website is accessible from. Finally you need to whitelist only those Countries allowed, for example via CIDR.

Improve this answer
1
  • It is hard to provide an answer for legislation of different countries. In my answer I provided a precise answer of the EU GDPR. UK GDPR should be the same. If you expect to get an answer for all jurisdictions you could wait for an answer forever.
    – Goemon Code
    May 26 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.