Don't underestimate the argument of "just to be on the safe side". Someone running a business who doesn't know a lot about cookies will often just put a banner on as an easy arse covering mechanism even when not required.

Or they had their site developed by an agency and the cookie banner is just part of their standard scaffolding for a new site.

Perhaps someone could publish a clear A/B test on how many views/conversions you lose by having a cookie banner?

That doesn't work, because you have to list what cookies you're asking for.

If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that?

The fact is most website operators want to use your data for non-essential purposes.

> I guess that most companies just chuck it up there as a default

50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.

> I guess that most companies just chuck it up there as a default so they dont have to read the law

I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.

If you use social media pixels, ad tracking, or performance analytics tools like Google Analytics a cookie banner and consent is required. If not, then not.

Side note: there’s plenty of Analytics tools that don’t require cookies. Plausible (https://plausible.io) is one of them, there are many others. Not affiliated, just a happy customer.

If you want to prevent a single user hitting F5 a million times from messing with your analytics you need to track IPs which requires the banner.

I'm not convinced this is a real concern. Bots, maybe, but then again even fancy analytics will be fucked by that because they use hundreds or thousands of high-reputation residential IPs. So, you're optimizing for the wrong thing I think.

No, you don't need consent for that. It falls under the legitimate interest exception.

You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.

>It falls under the legitimate interest exception.

What makes that a legitimate interest and not advertising?

Because preventing crime is drastically more important to having a functioning society than being able to target advertising slightly more accurately.

But how is wanting to show targeted ads not a legitimate interest. Without such a feature a site might be unprofitable and be shut down. If something is required to operate it sounds pretty important feature.

> and you can't use those logs for other purposes like ad targeting

This part I guess

Because he said so is not a good reason.

I’ve made a few sites for work that aren’t our primary focus. The sites used cookies for login and for “required purposes” (storing in progress state). We did all the tracking on the backend, no cookies or client side trackers.

On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…

Sounds like your legal department is broken. You should fix that.

I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).

It was a 30k person company, I worked for a subsidiary and for better or worse that was not within my circle of concern or circle of influence.

> We did all the tracking on the backend

Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.

I do but we shouldn’t be talking about cookies in our cookie banner then.

That's why the usual phrasing is some variation of "Are we allowed to track you? We use cookies for that".

It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.

You’re conflating GDPR and the ePrivacy Directive. They _should_ work how people imagine they do.

> it was never about the cookies themselves.

The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive.

> Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.

Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt?

And on tracking-less cookies not requiring one - that’s my entire point.

> I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies?

That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".