Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
We have an ecommerce site, and the promocode the user provides on the shopping bag is stored as a session cookie. Is this considered a strictly necessary cookie?
If the user rejects non-essential cookies should we show an error to the customer?
I read our regulation about this (UK's ICO), but it is not clear about this type of situation. I guess if someone knows the logic for the EU regulation, it would probably be the same for the UK.
https://gdpr.eu/cookies/ has a good summary of cookie usage under the GDPR in very readable language. It says:
Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies.
A first-party session cookie that is needed for functionality of the site to work would be classified as a "strictly necessary cookie." Your promo code cookie is strictly necessary to be able to claim the promotional discount.
If a user rejects non-essential cookies, you are NOT ALLOWED to block access to the site with an error message. The site is required to allow users to access it even if the user chooses not to store preference long term, or doesn't consent to tracking for statistics and marketing purposes. If the site can't be made to work without a first-party session cookie, that is a strong sign that that cookie is strictly necessary.
