[seanwilson]

> FYI this is a concrete example given by a regulatory authority of non-compliant behavior they observe in the wild, so it's not just theoretical.

Can you give a link to this?

Would it still apply to Crisp chat?

"You do not need to ask for user consent regarding Crisp cookies. Crisp uses cookies solely for messaging purpose, and not for tracking purposes."

https://help.crisp.chat/en/article/crisp-chatbox-cookie-and-...

Also, is there a good source to answer when you need and don't need a consent pop-up? It's maddening how difficult it is to get a straightforward yes/no for common use cases. Has nobody made a questionnaire/wizard where you tell it what you store and why, and it'll tell you if consent is required?

[lmkg]

The report I am referring to is this "cookie sweep" performed by the Irish DPA. It is especially significant because the Irish DPA is the one with jurisdiction over many US tech companies, who incorporate their EU operations in Ireland for tax reasons [PDF]: https://www.dataprotection.ie/sites/default/files/uploads/20...

There is not enough information in (that page of) Crisp's documentation to tell for sure whether they're compliant. The key question is: are cookies written when the JS loads, or only when the user initiates a chat session? They seem to be appealing to the "strictly necessary" exemption, but that only applies when the user actually tries to chat. Cookies set before a user tries to chat are not strictly necessary.

In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested. "Strictly necessary" and "service" should both be interpreted narrowly. That guidance only applies to reading/writing user device data, because it's governed by PECR rather than GDPR directly. GDPR allows a lot more leeway for collecting data for narrowly-defined-but-not-strictly-necessary reasons (like analytics).

The UK regulator, ICO, actually has some pretty thorough write-ups about cookies and consent and things of that nature. The UK is no longer part of the EU and its laws will diverge, but for the moment PECR and GDPR are both UK domestic legislation and will generally mirror EU law (except for international transfers). ICO's cookie guidanec: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

[seanwilson]

> In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested.

What's the rational behind this if the data stored locally isn't used for user tracking or even uploaded anywhere? By the same logic, why shouldn't we have to ask for consent to cache web files and to store data in a URL parameter?

Thanks for the links. I think part of the problem is there's just so much information and discussion on this, that it's hard to get a clear answer you can be 100% sure you can trust. PECR, GDPR, Irish DPA, ICO, UK law, EU law, cookie sweep... how are you suppose to keep up, know what applies to your particular case, and be sure you've interpreted and collated all the guidelines correctly?

[lmkg]

I hold a certification in information privacy, so my totally-biased answer is "hire an expert!" :p

The reading/writing requirements are from PECR, which is old and dumb. Passed in 2003ish, and was basically ignorable until GDPR changed the definition of consent. Updating it to include GDPR's much-saner concept of "Legitimate Interest" has been a priority goal for several years, but never actually happens.