4

Many cookie consent services – for example SecurePrivacy, CookieBot, and CookiePro – allow "cross-domain" consent, where consenting with cookie usage on one domain will imply consent on certain other domains as well. This means that after you've consented on e.g. example.org you are not shown the cookie consent dialog on app.example.org.

These services do not talk about the legal aspects of this functionality, so I'm wondering if it really is compliant with GDPR to do this? And what about CCPA?

I realize that any answers or comments are not legal advice and I will not take them as such. I'm just asking for some sort of justification or comments on the validity of this approach.

Improve this question
1
  • app.example.org is under the example.org domain. It is a separate host name, but a domain and its subdomains are often all part of the same site.
    – Stephen Ostermiller ♦
    Commented Mar 15, 2021 at 11:48

1 Answer 1

Reset to default
1

It is valid as long as you can comply to EU GDPR. You might need to dynamically generate some contents of the cookie banner consent (i.e.: domain name). Your domain name example.org and subdomain app.example.org refer to the same root domain name, and you can refer to *.example.org. It does not matter how you are compliant from a technical perspective. Keep in mind that you need to comply with both the EU GDPR and the ePrivacy Directive. Further reading: https://gdpr.eu/cookies/

You cannot expect legal advice here on webmaster StackExchange. Here you would find technical help. You might try on https://law.stackexchange.com/ for legal advice. Also, GDPR is available in EU and UK while CCPA is pertinent to California. You might try to split the question, and highlight the country specific regulation in the title. This could help you to get an answer quicker.

Improve this answer
4
  • This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review
    – Rohit Gupta
    Commented May 26, 2023 at 9:58
  • This question requires both technical and legal support. You should have proposed to move the legal aspect to law.stackexchange.com rather than criticising all my questions with the same copy and paste. Thanks
    – Goemon Code
    Commented May 26, 2023 at 12:08
  • They are not copy/paste answers, they are from a radio-button selection in the review queues, where all posts go through. I see that after lashing out at me, you have actually modified your answer, so it answers the question. Had you done that in the first place, my response in the review queue would have been different. And the flag is not a criticism of your knowledge, it's a criticism of the content of the post as an ANSWER to the question.
    – Rohit Gupta
    Commented May 28, 2023 at 11:50
  • Lashing? I don't think so, anyway that was not my intention. I like to improve my answers if I find further references/elements to add. As I have already wrote, the question expects some kind of legal advice which cannot be provided here. I just expected you highlighted this. I saw that you proposed some changes to other answers I posted regarding technical mechanisms required by the GDPR and ePrivacy directive, but they were rejected because confusing. Privacy matter is tricky, and make development of websites more difficult in some countries. I would not underestimate its complexity. Thanks
    – Goemon Code
    Commented May 30, 2023 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.