Hey everyone! I'm setting up an online platform based in the UK with a global customer base, but my hosting is in Germany. Right now, I have a cookie notification that says, "We use cookies to improve your experience. By browsing, you agree to our cookie usage. [Learn more]" with options to Accept and Reject. My site currently utilizes three cookies: a first-party session cookie for logins, a Stripe cookie for payment processing, and an XSRF-TOKEN for Laravel's CSRF protection. I'm wondering:
1. Do I need to provide customizable cookie options for users?
2. Is there anything else I should be aware of regarding cookie compliance?
5 Answers
This is definitely something to discuss with a lawyer. There can be nuances in regulations that developers often overlook.
It's a good idea to consult with a lawyer for specific legal advice. But from what I understand, if these cookies are essential for the site's operations, you might only need to inform users about their presence rather than getting full consent. The Stripe cookie, if only used for payment processing, could also be considered necessary. Just keep in mind that any cookies used for tracking would require user consent. Definitely check this with a legal expert, though!
About the cookie notification wording, there's a distinction you should be aware of. Saying users agree to cookies by browsing can be seen as an opt-out approach and might not comply legally. You might want to reword it to ask for active consent, like 'By clicking accept, you agree to our cookie use.'
I'm with you on that. Maybe something like, 'We use cookies essential for the operation of the website. By continuing to browse, you agree to our cookie policy?' No need for choices if they're necessary.
Just a heads up! If users opt out, make sure you actually stop any tracking. Many assume that opting out is just a formality but continue to track users anyway, which isn't cool.
To be honest, if you're only using the basic cookies you mentioned, I wouldn't stress about a cookie banner at all. Those consent requirements usually kick in if you're dealing with third-party cookies or tracking users.
Agreed! The understanding is that if the cookies are necessary for basic functionalities, then you just need to inform users instead of seeking opt-in consent.