They do come from the ePrivacy directive but;

> if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

No - you need consent for storing cookies that are not “strictly necessary”. I can implement an offline app that stores data in cookies without consent. The current usage of the banner is overly litigious US focused simplification combined with malicious compliance.

▲

nraynaud a day ago | parent | next [-]

in particular, if you store stuff in the browser, and don't send it to the server later (local storage or one of the other 1000 JS APIs), there is no reason to present a cookie banner.

▲

beej71 a day ago | parent | prev | next [-]

Do you have an example of a maliciously-complying website? Virtually all remotely popular websites deliberately use unnecessary cookies.

▲

yencabulator a day ago | parent [-]

Wanting to use unnecessary cookies is their choice, not something a law forced on them.

Non-malicious compliance with privacy laws would mean respecting people's privacy.

▲

beej71 a day ago | parent [-]

Maybe I'm ignorant of the gdpr, but does it ban tracking cookies?

▲

yencabulator a day ago | parent [-]

You might be ignorant on purpose. The law does not mention cookies at all, it says how personal/private information must be handled, and under what conditions collecting such is permissible.

▲

beej71 15 hours ago | parent [-]

Yes, but this exchange is in the context of cookies, as you brought up in your comment. And we're talking about companies maliciously complying with the cookie pop-up mechanism, are we not?

	▲	maccard 14 hours ago \| parent [-]
		The cookie pop up is a response to the ePrivacy directive, not GDPR.

▲

brainwad 2 days ago | parent | prev [-]

No cookie is strictly necessary, you can encode it all into request tokens in the URL, so this is a meaningless exception.

	▲	jampekka 2 days ago \| parent \| next [-]
		The law is not about cookies specifically, it's technology neutral. The law doesn't even include the word cookie anywhere. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
	▲	ninkendo a day ago \| parent \| prev \| next [-]
		So you’re saying if I log into HN, every intra-site link should be rendered with “?token=<secret>” and if I send a link to a friend it will let them be logged in as me? No, because that would be ludicrous, cookies are obviously necessary for the concept of a “login” or even just a “session” to exist.
	▲	rcxdude a day ago \| parent \| prev \| next [-]
		The ePrivacy directive basically defines it as 'any data your site gives to the user's terminal that the terminal then passes back to your site'. Request tokens in the URL would qualify, but notably storing something in localStorage with javascript that is never sent back would not.
	▲	bryanrasmussen 2 days ago \| parent \| prev [-]
		let me guess: you're some sort of programmer?! For a programmer of some sort this may seem a meaningless exception, for a lawyer it is not. I am not a lawyer, but I have had a few law classes and worked a bunch in the legal services branch. If I am asked legally speaking - is this cookie strictly necessary? I will ask is the cookie used only for the purposes of the service provided to the user and which the user expects to get. If the cookie is used so that when the user logs in and goes to page two of the article they are reading they can read that article without having to log in again we can say it is needed for the service. If the cookie is used to provide recommendations for other articles by using their user history to compare with other user histories and what other users like to read it is not needed for the service. Although from the point of view of the company it sure might be nice to have. If the cookie is used for your state management of the items you have placed in your basket so that you can go to buy those items it is needed, if the cookie is used to look up your past history and give you recommendations for other stuff to put in your basket, things you bought in the past why not buy some more of those, or how often you rated products you bought badly or anything not required for the current transaction you are doing to go smoothly it is not needed. As a general rule lawyers and the courts are good at sorting this stuff out, but as edge cases get complicated so does code, and nobody wants to handle all that stuff themselves, so instead they pay for a company that develops cookie banners and everybody gets asked if they accept cookies or not.