Hot answers tagged

31

As a European (Dutch) and a web builder: Yes, this is still required (if you have tracking/3rd party cookies). But now the cookie storm is over, and the dust has settled, most sites only show a small banner "we use cookies" and stick to that. Unless you're in the big league, there's not much to worry about, with just that notification you're already doing ...


22

Unless you do some sort of tracking, most cookies are exempt from that law. From the "EU Internet Handbook": Cookies clearly exempt from consent according to the EU advisory body on data protection include: user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., ...


12

Quora has a good answer for this: I imagine it's quite difficult to develop a study without significant biases. But here's one (A study of Internet users' cookie and javascript settings) that found in a sample of 13,500 visitors to their website 10% seemed to have 3rd party cookies turned off with only 3.7% disabling all cookies. They also ...


8

The first fines specifically for cookie law compliance failures have been handed out by the Spanish Data Protection Authority. They were given to two companies running a number of jewellery websites, one of which was an online store. Further Reading


8

I've been looking at this too, and I believe they fall under the category of pseudonymous data (most information taken from this helpful page): Article 4(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, ...


8

First of all, I'm not a lawyer but after reading the new law and analyzing Analytics, that's how I've been working since GDPR. The problem is that you can't track any user information without their consent, so, I started turning down all tracking functions. This is my roadmap: Avoid cookies using the function: storage: none Anonymize the IP with ...


6

Most bots don't accept cookies (including Googlebot), however, some bots do. You send a Set-Cookie header in the response, but the bot does not send back a Cookie header in subsequent requests - so the cookie is effectively lost. Whether Google is monitoring whether the site is setting cookies, we don't know for sure, but I'd wager they probably are. ...


6

Your find a lot of information by searching on Google, with any website if the website is accessible by a country or regional zone then you most comply with their rules and laws, if you don't agree then you should make attempts to notify users or block those users from your website. Hosting a website in X, a domain in X doesn't mean it can't break laws in ...


5

It is required by EU law that all websites operating in or targetting audiences in the EU must have a cookie notice. When they first introduced the policy, it was a strict consent, since then it has changed to notice only. So simply displaying a notice message to users complys with this non-sense law.


4

Steps for disabling a cookie -- php. I cant take credit for this its not my fix but im happy to spread the wealth. function deleteSpecificCookies() { var cookies = document.cookie.split(";"); var all_cookies = ''; for (var i = 0; i < cookies.length; i++) { var cookie_name = cookies[i].split("=")[0]; var cookie_value = ...


4

What is the problem with this cookie? You are using their service and want to benefit from their service and their security – according to Cloudflare, this cookie helps especially for security reasons. Regardless of that, this type of cookie is exempt from the cookie law message: However, some cookies are exempt from this requirement. Consent is not ...


4

No, there is no way to turn the cookie off if we are proxying the record (if you had a subdomain not running through our proxy in your DNS settings, then we wouldn't add the cookie because it is going direct to your server). The cookie is basically what makes security (like a challenge page) work.


4

As of Jun 10, 2014 Google recommends either ccTLDs, Subdomains with gTLDs or Sub-directories with gTLDs. URL parameters such as ?lang=en are not recommended: https://support.google.com/webmasters/answer/182192?hl=en#2 (Funny that the page which says that it's not recommended to use URL parameters for this, is actually doing exactly this.)


4

The BCSI-CS-**** cookie is set by the Blue Coat proxy servers. It's not set by the website being visited, but as a result of accessing the site through a network (like a company network) using Blue Coat technology. See also https://cookiepedia.co.uk/cookies/BCSI-CS-xxxxxxxxxxx and (for negative implications) https://www.ietf.org/mail-archive/web/http-state/...


4

Yes you can, try setting the cookie for .example.com as domain. That way, the cookie will be valid for every subdomain of yours. For example, PHP sessions would be like this: session_set_cookie_params(0, '/', '.example.com');


4

Just pass an option to do it: var io = require('socket.io')(); io.on('connection', function(client){}); io.listen(3000, { cookie: false }); See it in the docs: https://github.com/socketio/engine.io#methods-1


4

In short: it's very unlikely you'd see a negative SEO impact, but it still might not be a good idea. Google doesn't currently impose penalties, manual or algorithmic, for showing user details without authentication. The do punish "cloaking" (i.e. showing different content to Google than to a human user), but what you're proposing would not, in practice, be ...


4

You have no control over cookies that might be set by an external resource on a different domain. These (third party) cookies are set on the "external domain", not the domain of your site. Fundamental browser/cookie security prevents you from accessing these cookies (client-side) and the browser will never send these cookies back to your domain, so you will ...


4

The Google Search Console site you are looking at is specific to http. You need to also verify your new https site with the Google Search Console to see how it is performing. That drop for http is standard when you move to https. You should see the other property shows a sudden increase.


4

I think the answer is no. This page says Not all cookies are used in a way that could identify users, but the majority are and will be subject to the GDPR. That sounds like if there is no personal identifying information involved, such as just a high score, then GDPR doesn't apply.


3

You need to have separate URLs for Google to be able to index them separately. Using the same URLs for multiple languages won't work. You can dynamically serve the content on a single URL, but the individual language content needs to be on separate URLs too.


3

You cannot read cookies from other sites on your site, so you would have no way of doing this with generic cookies set on some other 3rd party domain. It would be technically possible if both your site and the other site used the same ad network. Then the ad network would be able to set a common cookie for the visitor and recognize them in both places. ...


3

Is this not what you are looking for? https://www.mediawiki.org/wiki/Extension:CookiePolicy?


3

This guidance (Guidance on the rules on use of cookies and similar technologies) from ICO(UK's independent body set up to uphold information rights) has a part related to the intranet: How do these rules apply to intranets? In our view the rules do not apply in the same way to intranets. The Regulations require that consent is obtained from the user ...


3

Depending on what cookie you mean exactly, 2 years would probably be the answer you're looking for based on this source: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage Additional details Google itself lists three main cookies that are set by the analytics script: "_ga" with a lifetime of "2 years" that is "Used to ...


3

When moving from http to https you will see http drop and https rise until all the 301 and 410 are integrated into https (google webmaster tools treats each protocol as different sites) As how to proceed, in my experience you just add the https version as a new property, set up the redirects in your server: use 302 (found) until you are sure the urls are ...


3

It's fine, there's no need to hide it. Google knows these things need to exist, and having one will not hurt your SEO. Indeed, many large sites, e.g., Android and Google themselves, don't hide their consent pop-ups. John Mueller from Google has spoken about this (as well as related concerns around penalties for intrusive popups and interstitials) at some ...


2

In response to the Yahoo Developer page, they are talking about you serving content on your site from www.example.com, but explicitly setting the domain of the cookie - in which case you have to set the cookie as either .example.com or .www.example.com. When you set a cookie, you have two options: Do not specify the domain name - in which case the cookie ...


2

The cookie specification indicates that you are correct: A is a FQDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a FQDN string. (So, x.y.com domain-matches .y.com but not y.com.) Even if you do use www.example.com for your site, you still probably want to set some cookies to *.example.com ...


Only top voted, non community-wiki answers of a minimum length are eligible