You do need consent even for the necessary exemption in practice because of how that is defined; the user must have explicitly asked for the function that requires the cookie:

> strictly necessary in order for the provider of an information society service *explicitly requested* by the subscriber or user to provide the service.

But this the basis for the OK-only style of banner, to inform the user that certain functions require and will use cookies if they use those functions.

▲

amiga386 a day ago | parent [-]

If you're in a shopping site and "add to basket" -- explicity requested.

If each page you browse on the shopping site shows what's currently in your basket -- explicitly requested.

If you checkout and get a list of what's in the basket and give you card details for payment and email for receipt -- explicitly requested.

No consent needed.

On the other hand, deliberately analysing log data after the fact for which products they looked at but didn't add to cart -- consent needed.

Javascript measuring which sub-parts of the page they lingered on -- consent needed.

Tracking how often they come back without buying anything -- consent needed.

Using the email address for anything other than order receipt and delivery status -- CONSENT VERY MUCH FUCKING NEEDED.

See the difference?

▲

brainwad a day ago | parent [-]

Dropping permanent cookies for any of this stuff is not strictly necessary; session cookies would be sufficient, so then to do anything convenient (e.g. persistent cart, Amazon-style) but not necessary you still need to request consent.

GDPR's legitimate interest basis is better written. But ePD is not superceded by GDPR, they are layered on top of each other.

	▲	amiga386 a day ago \| parent [-]
		That sounds like a wheeze that I've heard before. Site builders argue to themselves that what the regular user would want to do -- e.g. close the site and browser, come back to it and expect the items in the cart are remembered (for some amount of time, e.g. a month, not forever) -- is something the GDPR (or ePR) would strictly prohibit. Neither prohibit this. You can use persistent cookies or local storage for maintaining the user's cart. The reason they massively overstate what the regulations prohibit is because there are many things they want to do: user tracking and analytics, marketing engagement, etc., and know fine well the regulations prohibit that unless they get consent. So they pretend they can't possibly even do a basically functional site without getting consent, which is bollocks, so they don't feel so bad about imposing a consent banner on every visitor. The same thing happened in the UK where businesses told customers lies that "Health & Safety made me do this" or "the EU made me do this" https://web.archive.org/web/20190627174442/http://www.hse.go... https://web.archive.org/web/20200131200512/https://blogs.ec....