cookies gdpr
Is this Cookie scenario GDPR compliant?
<p>I noticed that many websites, including StackExchange websites just have a banner while full functionality is provided by the website, which is probably not GDPR compliant. Is this true?</p>
<p>As far as I know, legally you may not load <strong>ANY</strong> external JavaScript files or pictures without getting consent first.</p>
<p>So my prototype would be the following:</p>
<p>Every time a user visits the website under any URL the cookie consent will get checked and if the cookie is set already the user will get redirected to the URL they were visiting. But if they don't have the cookie (a.k.a. haven't given consent) no external pictures or JS gets loaded and the user goes to a captive portal where they got to accept the cookies.
Is this GDPR compliant? Is this secure enough?</p>
<p>Let me know whether this should be posted on Law StackExchange.</p>

<p>There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) is a way to continue nevertheless. A website without ads, tracking, or potentially tracking embedded content can probably work without having to ask for consent.</p>
<p>Under the GDPR, every processing of personal data needs a <em>purpose</em>. This purpose must be covered by a <em>legal basis</em>. Some processing might be legally mandated or required by a contract with the data subject. It's also possible to base processing on a <em>legitimate interest</em>, but this requires a balancing test that also considers the data subject's rights and interests. As a last resort, <em>consent</em> can be an appropriate legal basis, but this comes with additional restrictions. Once you have a clear purpose that is covered by a legal basis, you can process the minimum data necessary to achieve the purpose.</p>
<p>Sometimes, laws prescribe a particular legal basis. This is the case for cookies. You can use cookies (and similar technologies that access information on the end user's device) as strictly necessary to provide a service explicitly requested by the user. If you go beyond that, the ePrivacy Directive says you must obtain consent first. So for example, session cookies, shopping carts, or cookies that remember a “dark mode” preference are all perfectly fine because they are strictly necessary for something the user is trying to do. Also, you can use cookies to remember if the user gave or declined consent. On the other hand, analytics or tracking cookies are not necessary and require consent.</p>
<p>If a website embeds third party content, this discloses personal data such as IP addresses to the third party. This disclosure requires a legal basis, most likely consent. There is case law about this regarding Facebook Like buttons on a page (→ Fashion ID case) but the same principle can be generalized to embedded Tweets or Youtube videos, images, or JavaScript files. A common way to handle this is to replace the embedded content with a placeholder, and to only load the embed once the user gives consent.</p>
<p>But not all other domains or services are “third party” in the sense of the GDPR. When you engage a company to act as a data processor on your behalf, they are contractually bound to only use the data as instructed by you, and not for their own purposes. The GDPR allows you to outsource processing activities such as serving web content, as long as you have a suitable contract in place. Such “data processing agreements” are common for hosting providers or CDNs.</p>
<p>When <em>consent</em> is to be used as a legal basis, it's important to consider the various conditions that the GDPR imposes (see Art 7 GDPR). The core principle is that consent must be freely given. You cannot make access to a site conditional on consent, so a naïve cookie wall or captive portal will be non-compliant. It's fine to force a choice, but “no” MUST be valid and possible. That consent is freely given also means that you must provide enough context for the user to make an informed decision, that the user must give consent through an unambiguous, affirmative action (consent is never the default), and that consent must be specific for a particular purpose (you can't bundle unrelated purposes). That is why modern consent management tools have multiple layers of information and allow the user to give consent for individual purposes (e.g. yes to analytics but no to ad personalization).</p>
<p>In your particular context, you could proceed as follows:</p>
<ul>
<li>Figure out what kind of external content you're currently including.</li>
<li>Can you enter into a data processing agreement with the external providers? If so, sign that.</li>
<li>Can you host the content locally? This can be an easy solution except for video streams. Careful: copyright concerns might make this impossible.</li>
<li>Can you replace the content with placeholders that only load if and when the user gives consent? That way, the rest of your site remains accessible without annoying consent walls.</li>
<li>If the third party content is an unavoidable and essential part of your page, use an interstitial to inform the user of the risks before they proceed.</li>
</ul>
