← Back to context

Comment by rmunn

1 day ago

Considering they have a login system, I'm going to guess that the cookie includes your login (probably in JWT form), which automatically makes it essential to site functionality. Which means the banner is there just because if it was absent, someone would say "Hey, where's the cookie banner?"

In other words, it's not actually legally required in their case, but it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law.

> it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law.

Your "logic" is baffling

  • What I mean is that if they don't add it, they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner". Those regulators don't have any way of knowing how their site operates, so the small banner at least manages to inform them and keep Posthog from receiving emails.

    That is what I meant by "practically". I mean "in a practical sense" as opposed to in a theoretical sense.

    • > they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner".

      That literally does not happen. What world do you live in?

      But just to entertain your scenario let's say that did happen: it still wouldn't matter because they could just reply and tell them why they don't need one...

      1 reply →

    • So, this story is from people who heard things? I can guarantee you that regulators have zero time for proactively looking for MISSING cookie banners. If they had time, they'd crack down proactively on the cookie consent management systems used by thousands of websites that do not comply with the regulation, because they implement the reject option as a dark pattern. Furthermore, this weird fantasy request you just described can easily be dismissed by the website operators with a single sentence: We don't use cookies, hence no cookie banner.

      Individuals and other businesses have to complain to regulators about others not complying with the GDPR.

It's not legally required in terms of law, but it is legally required in the way that the legal department will complain if the banner not there. Checklists and all that. ;)