gdpr cookies
Essential cookies - legal responsibilities
<ul>
<li>I'm using <a href="https://stripe.com/privacy" rel="nofollow noreferrer">Stripe</a> to process payments on my site</li>
<li>The only cookies the site uses are set and processed entirely by Stripe</li>
<li>The cookies would only apply to users who have 1) created an account, and 2) signed up for a paid subscription</li>
<li>When signing up for an account, all users must accept the terms and conditions and privacy policy, which mentions the following:</li>
</ul>
<blockquote>
<p>We may use cookies and other tracking technologies to collect and
store your information.</p>
</blockquote>
<p>and under the Personal Information section:</p>
<blockquote>
<p><strong>Payment Data.</strong> We may collect data necessary to process your payment if
you make purchases, such as your payment instrument number (such as a
credit card number), and the security code associated with your
payment instrument. All payment data is store by Stripe. You may find
their privacy notice link(s) here:
<a href="https://stripe.com/privacy" rel="nofollow noreferrer">https://stripe.com/privacy</a></p>
</blockquote>
<p>I've read in some answers like <a href="https://law.stackexchange.com/questions/74311/gdpr-and-website-accept-cookies-window">this</a> one that the cookies are still my responsibility, since it's happening on my site, so I want to be sure I'm legally covered here in terms of GDPR and other cookie laws.</p>
<p><a href="https://law.stackexchange.com/questions/48833/cookie-laws-do-i-have-to-show-a-banner-for-technical-cookies">This</a> answer and <a href="https://law.stackexchange.com/questions/6112/what-happens-if-i-dont-accept-cookies">others</a> suggest that only non-essential cookies need to be announced with a banner and have the option to be turned off. My understanding is that for essential cookies, the legal requirement is to just disclose that cookies are used and for what purpose.</p>
<p>So with all that in mind, my questions are:</p>
<ol>
<li>Do my Stripe cookies count as essential cookies?</li>
<li>If the Stripe cookies count as essential, is it legal to provide no option to turn them off?</li>
<li>Have I met my legal requirements in terms of disclosure? The terms and conditions and privacy policy were generated by <a href="https://termly.io/" rel="nofollow noreferrer">Termly</a>.</li>
</ol>

<p>If the GDPR applies, then the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&amp;from=EN" rel="nofollow noreferrer">e-privacy directive</a> (EPD) (formally Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002) almost surely also applies. However, this being a directive rather than a regulation, the implement6ing laws may vary in different countries.</p>
<p>The relevant provision is Article 5 paragraph (3) which reads:</p>
<blockquote>
<p>Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, <em>inter alia</em> [among others] about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.</p>
</blockquote>
<p>This governs cookies <strong>and</strong> any other local data, that is, data stored on or read from the user's equipment.</p>
<p>What this means is:</p>
<ol>
<li>A site operator must disclose, in detail, what cookies or other local data the site stores on or reads from the user's device. Even strictly required data (cookies) must be disclosed.</li>
<li>A site may not store or read any local data until after consent has been obtained. The user must have the option to consent to or refuse consent to individual data items separately. Giving consent may not be a condition of permission to use the site. Consent must be opt-in, not opt-out, that is the default must be &quot;No consent&quot;.</li>
<li>Local data (including cookies) that is &quot;strictly necessary&quot; for the operation of the site is exempt from the requirement of consent, but not from the requirement of disclosure, and that means specific disclosure.</li>
<li>It must be at least as easy to cancel consent later as it was to give consent initially.</li>
</ol>
<blockquote>
<ol>
<li>Do my Stripe cookies count as essential cookies?</li>
<li>If the Stripe cookies count as essential, is it legal to provide no option to turn them off?</li>
<li>Have I met my legal requirements in terms of disclosure? The terms and conditions and privacy policy were generated by Termly.</li>
</ol>
</blockquote>
<ol>
<li>I don't know stripe well enough to be sure, but they might. What do they do that is essential for operating the site?</li>
<li>Yes.</li>
<li>No, not if the disclosures in the question are the only ones you make. As I understand it, you must provide at least a link to a page that shows each specific cookie that you read or set, and what data is stored in that cookie, even for strictly required cookies.</li>
</ol>
<p><strong>Update</strong>:</p>
<p>I should mention t6hat although the above describes my understanding of the current legal requirements, I have read that enforcement of those requirements does not seem to be a priority for the relevant authorities at this time. Other aspects of data protection, such as proper security to avoid data breaches, and having a proper legal basis for processing, and other GDPR requirements, as opposed to e-Privacy requirements, seem to get more attention and resources from the relevant  authorities.</p>
<p>Having read the comment by the OP, it does seem that at least some of the stripe cookies are strictly required and need not have consent.</p>
<p>The stripe cookie policy linked to is better than many sites currently offer. It does not go into fully specific detail, but it may be that the dashboard does, and that together the two are fully compliant. Linking to this policy (and if possible directly to the stripe cookie dashboard) would seem to me  to cover most of the issues here.</p>
