Comment by jebronie2
1 day ago
No, you need to always ask for consent for cookies if they come from a third party, regardless if they are only required to enable functionality. You also need to ask for consent each time data leaves the website (for example when loading an image from a third party host). You can't even load a font file from a third party server because the users IP reaches that server without consent. Cookie banners don't just handle third party tracking cookies, the are needed to record consent for a huge variety of cases. "Banning tracking cookies" does not remove the need for cookie banners.
Well if the cookie comes from a third party it implicitly allows tracking.
Also AFAIK the Google Fonts question (is the IP alone already PII, if Google has no way of tying the IP to a person) has not been decided by the ECJ yet. There've only been decisions by lower level German courts that are still in dispute.
IP addresses are PII according to german law, that debate has been settled long ago by final court-rulings afaik.
"Well if the cookie comes from a third party it implicitly allows tracking."
Yes, because this makes tracking possible you have to gather consent first, regardless if tracking actually happens. Very bad solution, they could just define how data can be legally used, instead of also overreaching by defining how data can be legally transmitted.
Putting assets on a 3rd party server is indeed a great way to track people. They can completely fuck off with all of that as well.
That's the problem with the regulation: It defines how data can be legally transmitted instead of defining only how data can be legally used, resulting in nasty side-effects like making embedding third-party content illegal even if its not used for tracking.