Do we really need a cookie consent banner?

[JorgeV]

Hello,

Adsense allows to disable interested based ads for EEA visitors. They claim that, as a result, they don't use "tracking" cookies (they use other kind of cookies). So in fact, do we really need a cookie consent banner? (since there is no "tracking" cookies, as claimed by Adsense).

The thing is, I feel silly, because, I am applying "what I understood", extremely strictly. I have a cookie consent banner (with explanations and links to more details, etc...) , and I display adsense only, when the visitors "effectively" agrees. Now, I think I am over doing it, compared to what others do. But I worry to get troubles, even if I am small, you know.

[lammert]

The GDPR is about personally identifiable information. If you use only non-personalized ads, there is no reason for the GDPR to use a Cookie Consent banner when purely looking at the cookie.

BUT

The GDPR is not the only European set of rules that covers cookies. Another somewhat newer work-in-progress is the ePrivacy regulation. This regulation covers electronic communications and it also covers non-personal data. If cookies are used for other purposes than the transmission and the security of the communication, cookie consent is necessary.

So if you want to be both GDPR and ePrivacy compliant, a cookie-consent banner is necessary in the EEA, even if you don't use Google's personalized ads option. The ePrivacy hasn't been implemented fully yet though.

And another important point to observe is that the GDPR talks about personally identifiable information when combining information like cookies, IP addresses, and other information. So even if a cookie itself does not contain any personalized information, the combination with the IP address used by the site visitor and previous search actions by that user may give the ability to build a personalized profile. In that case, also consent is required.