1

I have a generic question about SEO and cookies. Particularly when the site is hosted in the EU (like my private homepage). I'm currently redesigned my page and also improved the underlying PHP code. But there are more issues, which I must solve. I have already asked a similar technical question on Stack Overflow, but didn't get a answer at this time. The question was: Is it legitimate (or RFC conform), when I throw a 403 (Forbidden) code, when an user didn't accept the cookie banner?

I have also planned for SEO to allow search engines bots crawl the site without accepting the cookie banner. Will parse the User-Agent string. Is this legal? Sorry, for this maybe stupid question.

UPDATE:
For clarification (see my comment). My site currently doesn't use cookies. But an article from me use external resources. On which the corresponding site set cookies.

Another option for me is to disable these resources on the specified URL on my page for both real users (if they don't accept the cookie banner) and bots, to avoid cloaking. But mention this behavior from my site on the page.

Improve this question
3
  • Most sites do not forbid access based on the acceptance of cookies, but instead use that consent to either store or not store cookies. Whether that's "legitimate" or conforms to an RFC, I couldn't say. You may run into an issue with search engines that check for cloaking, since you should be displaying the same content to both them and users. We generally don't answer questions based on legality because we don't know your locale and we don't have any expertise in the law. You can try the Law Stack Exchange site for feedback in regards to that.
    – dan ♦
    Oct 19, 2021 at 0:41
  • @dan Thanks for the feedback. Currently my site didn't use cookies. But an article from me use external resources. On which the corresponding site use cookies. Okay, the cloaking may be the hard way. Is it another option to disable these external resources (for real users and bots)?
    – user123731
    Oct 19, 2021 at 0:56
  • No problem. I'd suggest editing your question to include your comment above to make it clearer that you're concerned with third-party cookies. Perhaps our users have some experience with how to handle that. In my experience, their privacy terms would be included in your own privacy terms that are linked to in your banner, and haven't experienced sites that outright forbid something they would publish to the public, but we'll see what others have to say.
    – dan ♦
    Oct 19, 2021 at 1:12

2 Answers 2

Reset to default
0

It is not legal under the GDPR to throw a 403 error when the user does accept cookies. See https://gdpr.eu/gdpr-consent-requirements/

Consent must be freely given

“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

In other words, your site must still work for users that don't consent. If you shut off access when a user does not consent, you are in violation of the law.

It would be perfectly reasonable to disable the third party resource that sets cookies if a user does not consent to cookies.

Improve this answer
1
  • Thanks for the clarification!
    – user123731
    Oct 26, 2021 at 5:10
0

It is legitimate to throw a 403 when a user does not accept a banner.

I expect parsing the User Agent string and providing differentiated results based on it is legal, although not a best practice and may get you in Googles bad-books.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.