# Cookie compliance under GDPR

**URL:** <https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275>\
**Category:** Community Building\
**Tags:** gdpr\
**Created:** [April 13, 2018, 7:10pm UTC](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275 "2018-04-13T19:10:56Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![allu](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@allu](https://meta.discourse.org/u/allu)\
**Post date:** [April 13, 2018, 7:10pm UTC](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275/1 "2018-04-13T19:10:57Z")

</div>

I would like to start a conversation on how to become GDPR compliant with regards to the use of cookies.

There was an old topic on EU cookie compliance here,

[https://meta.discourse.org/t/compliance-with-eu-cookie-law/17727](https://meta.discourse.org/t/compliance-with-eu-cookie-law/17727)

…but GDPR is a completely different requirement. While EU cookie compliance only required a statement placed at the bottom or at the top of the website, that lets the user know cookies are being used, GDPR requires giving the user a real and informed choice.

Cookies can be used to uniquely identify a person, therefore they should be treated as personal data. The legal basis for storing cookies will typically be consent. The requirements are:

- The users must have a choice. The fact that they use a website does not mean they agree to all cookies.
- Like all other consent under the GDPR, consenting to cookies needs to be a clear affirmative action. An example is clicking through an opt-in box (no pre-ticked boxes).
- The data subject should be able to withdraw consent as easily as they gave it.

The way I understand it, there currently is no standard solution for Discourse users to meet this requirement. If I am completely wrong about my interpretation of cookies and GDPR, or the use of cookies by Discourse, I will be glad to be told otherwise.

Searching around a little, I found some possible building blocks, for example this one:

[https://cookieconsent.insites.com](https://cookieconsent.insites.com)

**Pros** : OS / free

**Cons** : Mainly geared torwards old EU cookie law, doesn’t seem to support selective opt in/out. It seems to support withdrawing support, but it is not clear to me how this would integrate with Discourse. Maybe someone with good front-end skills can comment on that question.

Another choice I found was this one:

> **[Cookie Control from CIVIC](https://cookiecontrol.com/)**
>
> Cookie Control by CIVIC is the established GDPR consent management tool for managing your website's cookies.

**Pros** : Appears to be fully GDPR compliant, with granular control, easy withdrawal/change of settings at any time.

**Cons** : Costs between EUR 39 for one (sub)domain, up to EUR 199 for multiple (sub)domains (per year). I don’t really feel like spending those sums for cookie control. If I am going to spend money, I would much rather donate towards a open source Discourse plugin.

How are other Discourse “data controllers” planning to deal with cookies under GDPR? I am surprised that there isn’t more discussion going on about this, which leads me to think that I may have fundamentally misunderstood something.

---

_[View the full topic](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275)._