[maccard]

I’ve made a few sites for work that aren’t our primary focus. The sites used cookies for login and for “required purposes” (storing in progress state). We did all the tracking on the backend, no cookies or client side trackers.

On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…

[JoshTriplett]

Sounds like your legal department is broken. You should fix that.

I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).

[maccard]

It was a 30k person company, I worked for a subsidiary and for better or worse that was not within my circle of concern or circle of influence.

[jarofgreen]

> We did all the tracking on the backend

Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.

[maccard]

I do but we shouldn’t be talking about cookies in our cookie banner then.

[crote]

That's why the usual phrasing is some variation of "Are we allowed to track you? We use cookies for that".

It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.

[maccard]

You’re conflating GDPR and the ePrivacy Directive. They _should_ work how people imagine they do.

> it was never about the cookies themselves.

The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive.

> Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.

Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt?

And on tracking-less cookies not requiring one - that’s my entire point.