Google sites doesn't have a cookie opt out option, is this not in breach of GDPR?

[TwistedHelixis]

When a new user visits our Google Sites website it does pop up a message box about cookies, but there are no opt out options.

 

Is this not in breach of GDPR rules?

 

I did contact Google, they said the cookies are needed for the basic usage of the website and cant be disabled, hence the popup notice.

[andy_b]

I imagine:

 

"Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user."

[TwistedHelixis]

I imagine:

 

"Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user."

 

Would the following be Strictly necessary?

This in the pop up box

This site uses cookies from Google to deliver its services and to analyze traffic. Information about your use of this site is shared with Google. By using this site, you agree to its use of cookies.

 

The following is from the 'learn more' button in the popup box

https://policies.google.com/technologies/cookies

[FN-GM]

Do the cookies contain personally identifiable information?

[TwistedHelixis]

Do the cookies contain personally identifiable information?

We are not asking visitors to login, does that mean we are not collecting identifiable information?

[FN-GM]

We are not asking visitors to login, does that mean we are not collecting identifiable information?

 

What do you mean?

[paulkerton]

Any chance we can get this merged with:

http://www.edugeek.net/forums/cloud-services/225839-google-sites-analytics-cookies-just-need-some-basic-info-please.html

[rom1984]

We are not asking visitors to login, does that mean we are not collecting identifiable information?

 

Cookies can be a type of personal data in some circumstances, for example, a user authentication cookie. I think you are saying in this example they are not.

 

But I think the relevant legislation here is PECR rather the GDPR, although PECR uses the GDPR for some of its definitions - e.g. the definition of consent.

[RetiredBut]

If you will forgive an elderly style of thinking, why isn't there a 'Yes' or 'No' answer to the question of whether ANY Net entity must allow us to opt out of cookies?

 

I actually thought that was pretty much the law all over the planet, except in some nations where the law is super loose, or not at all.

 

I read something up above about essential cookies and must allow without choice (sorry for phrasing in my elderly style) but that seems to indicate that some company can refuse the option to not allow cookies.

 

Frankly, I thought that "You Must Allow' cookies stuff had been resolved a long time ago to the side that we had control over that one. Is somebody indicating here that we don't have that sort of control in some sort of special situation?

 

Again, I apologize for my blunt elderly human style of asking questions.

 

EDIT: And this edit is soon 3 hours and about 30 minutes later. Used the Google search engine and they seem to be stating the answer is "Yes" but it just hit me that might be only on their pages. But I'll still post the image:

 

Edited February 11, 2022 by RetiredBut

[RetiredBut]

I think I better do a second post now, instead of an edit.

 

Seems some government official or officials feel that maybe something is not all above board on some of Google's boards:

 

France fines Google a record $170 million for making it too difficult to opt out of cookies

Edited February 11, 2022 by RetiredBut

[GrumbleDook]

Whilst there is a GDPR element for this, you need to look more closely at PECR - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules9

[RetiredBut]

The way my old brain is processing that information you provided the link for, GrumbleDook (and thank you for that link), is that under the first of the two exemptions:

 

#1:

So, for the exemption to apply, the transmission of the communication must be impossible without the use of the cookie. Simply using a cookie to assist the communication is insufficient for the exemption to apply.

 

My fogged up brain is seeing the two keys words as "impossible" and "assist" and I would then describe that as: It is impossible for me to assist you without this cookie, so sorry, me use with or without your consent. In fact, you don't even know me using it, does you?

 

Then we move to #2, which has this very cute example:

 

Example

 

A user visits an e-commerce website and decides to purchase a product.

 

The cuteness I find is that the 'customer' ("user" is so frigging impolite) - - - the customer must have already agreed to the cookies to be at that stage of being able to purchase something, or so my feeble brain would be guessing.

[GrumbleDook]

Going to an ecommerce site will have cookies hitting you as soon as you arrive (you are a user until you make a purchase - then you are a customer). They are part of the function of the site, but the extent depends on how far in you are. You are informed of this in the privacy notice *and* cookie controls.

If you are not happy you can leave the site and scrub the cookie.

 

This is for the ecommerce section of a site though. It may be that other sections of the site do not need those levels of cookies. Some might be about language preference. The site may pick up the default language of your browser, but offer you options. You choose UK instead of US, so they drop a cookie as a result. You go to a .com page but the Geolocation of the IP address suggests UK, they offer you an option, then drop a cookie based on that.

 

The problem is that a number of sites and services drop cookies to establish 'defaults' when they are not needed. These 'defaults' *can* (but not always) affect other services you go to as a result (assists?). The discussion about whether these are essential or assists is part of the argument on these cases. The fact that some cookies can also be used for tracking and fingerprinting is that crossover into GDPR. There are lawyers who specialise and get paid serious money to trawl through case law and legislation on this.

 

There are two main gripes about it all. Companies are not transparent (sticking it up there but in legalese does *not* make it transparent) and the use of dark patterns, or other means, to make it difficult for the end-user to control anything getting dropped on their machines. Anything involving AdTech will hit these. It is down to companies to manage it better. But the bulk of cookie issues are still going to be PECR-based rather than GDPR (thought it may easily involve the two).

[RetiredBut]

GrumbleDook, please forgive my being so late with this question and also please do not get upset, if possible, because I am sort of asking for educational purposes; in that I am very interested in the difference in attitudes related to human activity on the surface of the planet and human activity on the Internet.

 

Do you view a human that walks into a grocery store as not being a customer until they place something into their shopping cart? I suppose the same question applies to a human that walks into a department store where there is less likelihood of them pushing around a shopping cart.

 

In fact, let us consider how we view humans here in this Online Community. We have members and we have guests, if we are giving consideration to the humans wandering around here with those "bot" things. But the vocabulary "member" and the vocabulary "guest" are very human and very polite.

 

But to be referred to as a "user" reminds me of back in the 60s and 70s when a "user" was somebody doing that needle-using drug stuff and was a very bad way to refer to a human being.

 

I'm just explaining the 'why' of my post before yours, GrumbleDook, when I stated I thought it was impolite to refer to us as users.

 

Actually, since the days of radio there has been this weird sort of taking the human element out of those that use these new communications tools. It was "listener" when radio came out. Then that became "viewer" when television became affordable to the average household, and now it is "user" that is in fashion. Yes, it could be stated that "listener" and "viewer" were very useful and appropriate, but when we shop online and are referred to as a "user" before we have made up our minds as to whether to buy something or not, ... - - - Okay, I'll stop before simply repeating myself.

[elsiegee40]

I am not GD, but here’s my take on it…

GrumbleDook, please forgive my being so late with this question and also please do not get upset, if possible, because I am sort of asking for educational purposes; in that I am very interested in the difference in attitudes related to human activity on the surface of the planet and human activity on the Internet.

 

Do you view a human that walks into a grocery store as not being a customer until they place something into their shopping cart? I suppose the same question applies to a human that walks into a department store where there is less likelihood of them pushing around a shopping cart

From the store’s perspective it is exactly that. A customer is someone who has paid for goods. Anyone else in the store is potentially a customer and what the store is trying to do is ensure as many of the people as possible become customers

 

In fact, let us consider how we view humans here in this Online Community. We have members and we have guests, if we are giving consideration to the humans wandering around here with those "bot" things. But the vocabulary "member" and the vocabulary "guest" are very human and very polite.

 

But to be referred to as a "user" reminds me of back in the 60s and 70s when a "user" was somebody doing that needle-using drug stuff and was a very bad way to refer to a human being

In IT terms a User is simply someone who uses the IT services, be that connecting to hotel wifi, using a company’s laptop or browsing a website.

 

It distinguishes people using the services from those who are Administering them. ‘Systems Administration’ is supplying those IT services and all the updates, etc that are required… ie what the IT technical staff do.

 

That administration word is one that those outside the IT world might associate with pens and word processors, but here’s the definition and that has drug associated meanings too.

Systems Administration is both senses… manage and apply a remedy.

 

Users can be teachers, potential customers, staff, students… even we IT people are service users, but ones with more potential to break things.

 

The term User is so widely used across the IT industry and it literally has no references to drug culture nor was ever intended to. Its definition precedes computing and modern drugs culture alike.

 

 

I'm just explaining the 'why' of my post before yours, GrumbleDook, when I stated I thought it was impolite to refer to us as users.

 

Actually, since the days of radio there has been this weird sort of taking the human element out of those that use these new communications tools. It was "listener" when radio came out. Then that became "viewer" when television became affordable to the average household, and now it is "user" that is in fashion. Yes, it could be stated that "listener" and "viewer" were very useful and appropriate, but when we shop online and are referred to as a "user" before we have made up our minds as to whether to buy something or not, ... - - - Okay, I'll stop before simply repeating myself.

I started out in IT in the days of punch cards so my grey hair is caused by a lot of changes through the decades. You are the first person I have heard who objects to the term which doesn’t mean I am dismissing what you said. It has given me pause for thought.

Edited June 19, 2022 by elsiegee40

[RetiredBut]

I remember the first days of the punch cards when my wife was working in a U.S. Army finance company.

 

But I am posting because I am very confused. You sincerely do not view any person walking through the doors of a store, be it a grocery store or a department store, as a customer, elsiegee40?

 

I'll have to admit that I haven't lived in an English speaking environment for over 40 years, so I am very likely missing a change in some aspect of the culture of a city or town in such a land, but I do/did frequent military facilities and I only recall being referred to as a customer in any commercial facility on any number of those military bases/establishments.

 

Of course, I may be misunderstanding your post, so please forgive me if I have the wrong read of that "... it is exactly that."

 

Well, I guess, after I think about it, the only form of address directly to me is the basic question "May I help you?" and so no need for any such use of "customer" in a simple dialog between myself and staff. But I really wasn't aware of any sort of description other than customer for anyone that walked through the doors of such like the PX/BX, the commissary, and so on. Civilian type commercial establishments I have used in the past 40 something years have not been in an English-speaking nation, so maybe that thinking should not be included here.

 

But this sure does have me wondering just how much has changed since the last time I was in North America above the border with Mexico, or other English-speaking areas of the planet.

Edited June 19, 2022 by RetiredBut

[elsiegee40]

I remember the first days of the punch cards when my wife was working in a U.S. Army finance company.

 

But I am posting because I am very confused. You sincerely do not view any person walking through the doors of a store, be it a grocery store or a department store, as a customer, elsiegee40?

 

I'll have to admit that I haven't lived in an English speaking environment for over 40 years, so I am very likely missing a change in some aspect of the culture of a city or town in such a land, but I do/did frequent military facilities and I only recall being referred to as a customer in any commercial facility on any number of those military bases/establishments.

 

Of course, I may be misunderstanding your post, so please forgive me if I have the wrong read of that "... it is exactly that."

 

Well, I guess, after I think about it, the only form of address directly to me is the basic question "May I help you?" and so no need for any such use of "customer" in a simple dialog between myself and staff. But I really wasn't aware of any sort of description other than customer for anyone that walked through the doors of such like the PX/BX, the commissary, and so on. Civilian type commercial establishments I have used in the past 40 something years have not been in an English-speaking nation, so maybe that thinking should not be included here.

 

But this sure does have me wondering just how much has changed since the last time I was in North America above the border with Mexico, or other English-speaking areas of the planet.

 

This is predominantly a UK based, technical forum and the language choices made are those of IT professionals talking to each other in the workplace. It is not necessarily the vocabulary we would use when talking to non IT colleagues in or outside our workplace.

 

I also think some things here may be lost in translation between US English and British English.

 

 

Now I must put my Moderator hat on and insist this thread returns to topic.

 

Further discussion on language choices will be removed

 

[GrumbleDook]

I think this is a valid discussion, for language and how the use of it varies depending on audience is a key element to transparency.

Some terminology used may seem impersonal and even clinical, but that has been done to ensure clarity around the separation in activities affecting individual people.

Going back to how this affects the original query, the language used to explain why someone visits/uses Google Workspace for Education may seem opaque but essentially it is to take part in activities as set out by the school. Where cookies are essential to allow that to happen, they can be deemed strictly necessary.

Where any cookies are not essential (eg any linked to AdTech or used purely for the benefit of the provider) then they have to be clear and the lack of consent cannot affect how the site works.

This is one reason why many of us have concerns about staff pushing children to online resources that are full of adverts, drop cookies that are not strictly necessary even before any cookie message comes up and who try to get consent (under both PECR and GDPR) to use cookies and the personal data gathered from it.

There are other things that could be discussed here (linking into the recent Human Rights Watch report) but they could end up as discussions full of materials from significant areas of research that I would poorly explain.

Once I’ve found a better and clearer way of explaining it I will happily come back to this discussion, but my earlier explanation is the best I can do right now.

[paulkerton]

I remember the first days of the punch cards when my wife was working in a U.S. Army finance company.

 

But I am posting because I am very confused. You sincerely do not view any person walking through the doors of a store, be it a grocery store or a department store, as a customer, elsiegee40?

 

I'll have to admit that I haven't lived in an English speaking environment for over 40 years, so I am very likely missing a change in some aspect of the culture of a city or town in such a land, but I do/did frequent military facilities and I only recall being referred to as a customer in any commercial facility on any number of those military bases/establishments.

 

Of course, I may be misunderstanding your post, so please forgive me if I have the wrong read of that "... it is exactly that."

 

Well, I guess, after I think about it, the only form of address directly to me is the basic question "May I help you?" and so no need for any such use of "customer" in a simple dialog between myself and staff. But I really wasn't aware of any sort of description other than customer for anyone that walked through the doors of such like the PX/BX, the commissary, and so on. Civilian type commercial establishments I have used in the past 40 something years have not been in an English-speaking nation, so maybe that thinking should not be included here.

 

But this sure does have me wondering just how much has changed since the last time I was in North America above the border with Mexico, or other English-speaking areas of the planet.

 

This has a very Abe Simpson "We tied an onion to my belt, which was the style at the time..." vibe.