0

Background info

This question is about the functional implications of the "EU cookie law" in browsers. General Data Protection Regilation (GDPR) is implemented in EU starting from May 2018 and ironically does not directly mention cookies... However as it is currently phrased it has direct impact on the use of browser cookies. I have no intent to discuss the GDPR itself nor to go into further details of explaining it. For additional reading please see:

Question

Actual question may be very simple but I honestly could not find an answer to it in google. So here it is:

There are two ways to deal with cookies: Either by managing cookie options on per site basis or by changing setting in browser. For me it is unclear which one of these two methods has a priority.

Consider the following examples:

Jack does not mind cookies. In fact he loves them. He has nothing to hide and is happy for every website he visits to store those tiny bits of information that enable third-party companies to pick and choose adds suitable for him. So he goes and configures his browser to set accept all cookies. Yet this does not stop sites from displaying cookie consent banners which annoy Jack a lot. (Here are few exampels of Jacks: one, two )

Bob unlike Jack is a bit of a paranoid (aren't we all?). He does not want anyone tracking him and using his personal info for statistical analysis and market research. Seeing an add that somehow relates to Bob's yesterday's google search makes him jump up in a chair. So Bob goes and disables third-party cookies in his browser. But again just like with Jack websites keep showing him consent banners. To make it worse these banners are all formatted differently and require to go into sub-sub-sub-sub-options in order to actually reach the needed settings and disable third-party cookies. Everytime Bob goes into these submenus, website navigates away from the content Bob was reading which upsets him. (Here is a Bob)

So in the end what has a higher priority? Browser settings or website consents?

Can Bob just tweak his browser and then keep clicking "Accept all" knowing that it does not mean anything as his browser will still prevent unwanted cookies? And is there any hope at all for Jack who wants to blanket-accepta-all? Will Jack still need to see this ugly banners blocking his device screen?

Community
  • 1
Art Gertner
  • 7,149
  • 11
  • 42
  • 72

1 Answers1

1

You get the sum of all restrictions, since they work independently.

  • Websites can send cookies, but cannot force your browser to accept them.
  • Browsers can ignore received cookies, but cannot tell websites to start or stop sending them.

So if your browser is set to ignore all third-party cookies, it will ignore them, regardless of how many GDPR prompts you click through. The browser's restriction takes priority over the website's permission.

On the other hand, if you've previously blocked cookies on both ends (local and website), but then reconfigured your browser to accept all cookies, the websites will still remember your earlier GDPR consent or lack thereof. So the website's restriction takes priority over the browser's permission.

(Well, assuming that you at least accepted the cookie which stores GDPR settings... But if you blocked that as well, then the website won't have any way to remember your preferences and will keep asking every time.)

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966