"R.Wieser" <add...@not.available> wrote:
> "R.Wieser" <add...@not.available> wrote ...
>
>> And for the off chance that you simply have no clue : session cookies - as
>> part of the "functional cookie" group - are excluded from the GDPR
>> requirements.
>
> I put that wrong : They are not /excluded/, but as (long as) those cookies
> do not contain PII the GDPR has nothing to say about them.
Session cookies are [supposed to] get erased when the web session exits.
Doesn't always happen. I used "session" incorrectly for those who
understand that term regarding cookies. The cookies they use prevent
further user intervention during the web session. They might be session
cookies. They might be regular cookies. It's their presence during a
web session that dictates if there is interruption on revisit to a site
(i.e., further user intervention required). Whether those remnant
expiring (not session) cookies after a web session get reused in the
next web session with the same site depends on what the site wants to do
with them which means again with the user intervention to grant consent.
With a session cookie, it shouldn't be there in the next web session,
but are there in revisiting a site during the same web session. An
expiring cookie would surive a web session, and be available in the next
web session if the site is revisited. That expiring cookies survive to
the next web session does not guarantee that the user will not be again
interrupted with a consent prompt.
The point of user intervention to grant consent really has nothing to do
with the content of the session or expiring cookie file. They are used
as a means of tracking visitation, and whether or not to interrupt with
a consent prompt. They don't need any personal information at all to be
employed in managing a consent prompt, so they would always be exempt
from the GPDR regulations (unless endpoint tracking is considered
personal information).
"Any information relating to an identified or identifiable *natural*
person ('data subject'); and indentifiable natural person is one who can
be identified, directly or indirectly, in particular by reference to an
identifier such as name, and identification number, location data, an
online identifier or to one of more factors specific to the physical ,
physiologiccal, genetic, mental, economic, culteral or social identity
of that natural person."
So, does use of tracking to an endpoint, a computer, qualify as tracking
a natural person? How can any site validate that only one person uses
the one computer as the endpoint host that connected to that site? It
can't hence the legal indemnification used by sites to overtly request
consent by visitors. It's not that they are required by GPDR. It's
them covering their legal ass should the vaguities of GPDR be judged
against a site as a violation.
Oh, as far as whether cookies have personal content within, I didn't
find that mentioned. Since cookies can be used for tracking:
https://piwik.pro/blog/how-will-gdpr-affect-your-web-analytics-tracking/
Since cookies can be used for tracking of an endpoint (computer), they
can be considered "personal data" if there is potential to single out an
individual. However, the endpoint is singled out, not a natural person.
Companies don't want to bother legally battling the distinction, so they
put out the consent prompt to encompass any possible interpretation
between endpoint host and natural person.
I'm not a lawyer, nor would I ever want to be one, nor do I believe are
you. But just casual perusing of the GPDR shows it isn't that clear,
and why any judgement of violation for a particular case would require a
court case rather than mandates from some overreaching document.
Companies enlist lawyers to give suggestions of preventing liability.
Tis simple 'nuff to shove a consent form at visitors to nuisance them
rather than determine interpretation in court. The same shit happened
regarding Usenet access by ISPs when a New York state attorney simply
threatened court action for just having Usenet access due to the kiddie
porn back then. Gave the ISPs an excuse to drop Usenet. That was their
cheapest, easiest, and best indemnification against legal action.
Shoving a consent prompt into their visitors' faces was also cheap and
easy indemnification instead of determining their liability in court.