Many cookie consent services – for example SecurePrivacy, CookieBot, and CookiePro – allow "cross-domain" consent, where consenting with cookie usage on one domain will imply consent on certain other domains as well. This means that after you've consented on e.g. example.org you are not shown the cookie consent dialog on app.example.org.

These services do not talk about the legal aspects of this functionality, so I'm wondering if it really is compliant with GDPR to do this? And what about CCPA?

I realize that any answers or comments are not legal advice and I will not take them as such. I'm just asking for some sort of justification or comments on the validity of this approach.

  • app.example.org is under the example.org domain. It is a separate host name, but a domain and its subdomains are often all part of the same site. – Stephen Ostermiller Mar 15 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.