Hot answers tagged

30

As a European (Dutch) and a web builder: Yes, this is still required (if you have tracking/3rd party cookies). But now the cookie storm is over, and the dust has settled, most sites only show a small banner "we use cookies" and stick to that. Unless you're in the big league, there's not much to worry about, with just that notification you're already doing ...


19

Unless you do some sort of tracking, most cookies are exempt from that law. From the "EU Internet Handbook": Cookies clearly exempt from consent according to the EU advisory body on data protection include: user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., ...


12

The UK Information commisioner says in their guidance document on cookies: "An organisation based in the UK is likely to be subject to the requirements of the Regulations even if their website is technically hosted overseas." So it depends on where you are based, not where you are hosted.


12

Quora has a good answer for this: I imagine it's quite difficult to develop a study without significant biases. But here's one (A study of Internet users' cookie and javascript settings) that found in a sample of 13,500 visitors to their website 10% seemed to have 3rd party cookies turned off with only 3.7% disabling all cookies. They also ...


7

I've been looking at this too, and I believe they fall under the category of pseudonymous data (most information taken from this helpful page): Article 4(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, ...


6

You can't share cookies across domains. You may share across subdomains. So, if your domain wrote the cookie stored on the client - whether in an iframe from other site or stored by visiting your main site, your domain should be able to access it. Otherwise - no. Here's some good info on the matter (over on SO)...


6

No one will actually be able to answer this until there is a test case in front of a court, then there is a separate question of how enforcement will work. I would suspect that the likely outcome of any case will be that any website hosted on a European domain name or server will be covered by the law, and this will be enforced by the registries. Equally I ...


6

The problem with your set-up (from an SEO standpoint) is that search engines don't accept cookies, so whenever a bot follows a link to your root domain, it'll be sent to your English content. Hopefully, there's an abundance of links to the other language content, too, but in my experience, this situation nevertheless seems to lie at the root of a lot of ...


6

Most bots don't accept cookies (including Googlebot), however, some bots do. You send a Set-Cookie header in the response, but the bot does not send back a Cookie header in subsequent requests - so the cookie is effectively lost. Whether Google is monitoring whether the site is setting cookies, we don't know for sure, but I'd wager they probably are. ...


6

Your find a lot of information by searching on Google, with any website if the website is accessible by a country or regional zone then you most comply with their rules and laws, if you don't agree then you should make attempts to notify users or block those users from your website. Hosting a website in X, a domain in X doesn't mean it can't break laws in ...


6

The first fines specifically for cookie law compliance failures have been handed out by the Spanish Data Protection Authority. They were given to two companies running a number of jewellery websites, one of which was an online store. Further Reading


5

First of all, I'm not a lawyer but after reading the new law and analyzing Analytics, that's how I've been working since GDPR. The problem is that you can't track any user information without their consent, so, I started turning down all tracking functions. This is my roadmap: Avoid cookies using the function: storage: none Anonymize the IP with ...


4

The LinkedIn Share Button is available with or without count mode. If you select the no count mode and you host the button image on your server, there's no way for LinkedIn to track user sessions or get other user information from your website. Otherwise (if you want to be paranoid), LinkedIn might actually know when a user requests a page on your site and ...


4

This is SEO friendly and won't cause you any problems with the search engines. Lots of websites don't have their root web directory as their home page. By doing the 301 redirect you are making it clear that http://example.com/nicy is your homepage and any links pointing to http://example.com/ should be associated with http://example.com/nicy (although with a ...


4

You can Get/Detect/check for existance of cookie through RewriteCond %{HTTP_COOKIE} Set Cookie value with the RewriteRule flag cookie|CO which has this syntax: [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly] An example with them both together: RewriteCond %{HTTP_COOKIE} cookiekey=cookievalue [NC] RewriteRule ^(.*)$ /$1 [L,CO=cookiekey:NewCookieValue:...


4

The BCSI-CS-**** cookie is set by the Blue Coat proxy servers. It's not set by the website being visited, but as a result of accessing the site through a network (like a company network) using Blue Coat technology. See also https://cookiepedia.co.uk/cookies/BCSI-CS-xxxxxxxxxxx and (for negative implications) https://www.ietf.org/mail-archive/web/http-state/...


4

As of Jun 10, 2014 Google recommends either ccTLDs, Subdomains with gTLDs or Sub-directories with gTLDs. URL parameters such as ?lang=en are not recommended: https://support.google.com/webmasters/answer/182192?hl=en#2 (Funny that the page which says that it's not recommended to use URL parameters for this, is actually doing exactly this.)


4

No, there is no way to turn the cookie off if we are proxying the record (if you had a subdomain not running through our proxy in your DNS settings, then we wouldn't add the cookie because it is going direct to your server). The cookie is basically what makes security (like a challenge page) work.


4

What is the problem with this cookie? You are using their service and want to benefit from their service and their security – according to Cloudflare, this cookie helps especially for security reasons. Regardless of that, this type of cookie is exempt from the cookie law message: However, some cookies are exempt from this requirement. Consent is not ...


4

Yes you can, try setting the cookie for .example.com as domain. That way, the cookie will be valid for every subdomain of yours. For example, PHP sessions would be like this: session_set_cookie_params(0, '/', '.example.com');


4

I removed the lines below and it removed the cookie line 14 //var cookieMod = require('cookie'); line 47 //this.cookie = false !== opts.cookie ? (opts.cookie || 'io') : false; line 48 //this.cookiePath = false !== opts.cookiePath ? (opts.cookiePath || '/') : false; line 49 //this.cookieHttpOnly = false !== opts.cookieHttpOnly; line 290 - line 298 //if (...


4

In short: it's very unlikely you'd see a negative SEO impact, but it still might not be a good idea. Google doesn't currently impose penalties, manual or algorithmic, for showing user details without authentication. The do punish "cloaking" (i.e. showing different content to Google than to a human user), but what you're proposing would not, in practice, be ...


4

It is required by EU law that all websites operating in or targetting audiences in the EU must have a cookie notice. When they first introduced the policy, it was a strict consent, since then it has changed to notice only. So simply displaying a notice message to users complys with this non-sense law.


4

The Google Search Console site you are looking at is specific to http. You need to also verify your new https site with the Google Search Console to see how it is performing. That drop for http is standard when you move to https. You should see the other property shows a sudden increase.


4

I think the answer is no. This page says Not all cookies are used in a way that could identify users, but the majority are and will be subject to the GDPR. That sounds like if there is no personal identifying information involved, such as just a high score, then GDPR doesn't apply.


3

In the requests towards the (non-SPDY) website I work for i've seen requests with up to 4-5 KiB of request headers. (we kicked the offending javascript that caused that) Assuming the SPDY compression does at least a compression to leave at most 25% of a header (note that I have NOT tested SPDY yet!!!) then the resulting request header goes down to a size ...


3

OK - I think I've just solved it, thanks to Dave and Emil; whilst you didn't hit the nail on the head - you did make me look in the right sort of place (and reminded me of Fiddler to debug). Theoretically, what I was doing should not have broken the cookie but it was, but only sometimes (e.g. it worked fine accessing the online dev server from home but not ...


3

You need to have separate URLs for Google to be able to index them separately. Using the same URLs for multiple languages won't work. You can dynamically serve the content on a single URL, but the individual language content needs to be on separate URLs too.


3

You cannot read cookies from other sites on your site, so you would have no way of doing this with generic cookies set on some other 3rd party domain. It would be technically possible if both your site and the other site used the same ad network. Then the ad network would be able to set a common cookie for the visitor and recognize them in both places. ...


Only top voted, non community-wiki answers of a minimum length are eligible