|
|
|
|
|
|
by lmkg
2113 days ago
|
|
|
The report I am referring to is this "cookie sweep" performed by the Irish DPA. It is especially significant because the Irish DPA is the one with jurisdiction over many US tech companies, who incorporate their EU operations in Ireland for tax reasons [PDF]: https://www.dataprotection.ie/sites/default/files/uploads/20... There is not enough information in (that page of) Crisp's documentation to tell for sure whether they're compliant. The key question is: are cookies written when the JS loads, or only when the user initiates a chat session? They seem to be appealing to the "strictly necessary" exemption, but that only applies when the user actually tries to chat. Cookies set before a user tries to chat are not strictly necessary. In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested. "Strictly necessary" and "service" should both be interpreted narrowly. That guidance only applies to reading/writing user device data, because it's governed by PECR rather than GDPR directly. GDPR allows a lot more leeway for collecting data for narrowly-defined-but-not-strictly-necessary reasons (like analytics). The UK regulator, ICO, actually has some pretty thorough write-ups about cookies and consent and things of that nature. The UK is no longer part of the EU and its laws will diverge, but for the moment PECR and GDPR are both UK domestic legislation and will generally mirror EU law (except for international transfers). ICO's cookie guidanec: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... |
|
|
What's the rational behind this if the data stored locally isn't used for user tracking or even uploaded anywhere? By the same logic, why shouldn't we have to ask for consent to cache web files and to store data in a URL parameter?
Thanks for the links. I think part of the problem is there's just so much information and discussion on this, that it's hard to get a clear answer you can be 100% sure you can trust. PECR, GDPR, Irish DPA, ICO, UK law, EU law, cookie sweep... how are you suppose to keep up, know what applies to your particular case, and be sure you've interpreted and collated all the guidelines correctly?