16 ms·

Naively did not realise using cloudflare as a cdn meant subjecting users to cookies. I don't have a consent banner... Does Netlify?

by Jsharm 6y ago

deleted 6y ago
[deleted]
donbrae 6y ago
Netlify doesn't seem to have a consent banner but sites hosted on it don't set cookies, despite using Cloudflare (at least that's my experience hosting a blog on it).
- iruoy 6y ago
  Netlify doesn't use cloudflare. Their DNS[1] is managed by NS1 and they host their websites on the edge[2] instead of using a cdn. [1]: https://ns1.com/blog/netlify-leverages-ns1-to-improve-performance-across-60-000-sites https://ns1.com/blog/netlify-leverages-ns1-to-improve-perfor... [2]: https://www.netlify.com/products/edge/ https://www.netlify.com/products/edge/
  - donbrae 6y ago
    Ah, thanks. Didn’t realise that.
wongarsu 6y ago
At least under EU cookie laws and GDPR you shouldn't need a consent banner for Cloudflare cookies, as they provide essential functions (for availability and security) and don't track users. You might have to mention them and their purpose in your privacy policy though. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies https://support.cloudflare.com/hc/en-us/articles/200170156-U... goes in some detail what the cookies do and (more importantly here) what they don't do.
- ancymon 6y ago
  You might be kind of wrong. I think you don't need consent. But the cookie law still requires notification banner (which is basically the same thing). That's because cookie usage by itself (no matter the purpose) requires notification.
  - ATsch 6y ago
    https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... Here's what the UK Regulator says. It's a bit unfortunate, there was a follow-up to this law that much improved the cookie nagging, but unfortunately it seems to have been stopped in it's tracks by lobbyists because of its restrictions on ad tracking.
    - deleted 6y ago
      [deleted]
    - wongarsu 6y ago
      Following the link from there to https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules1 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... you find this paragraph: """ Are we required to provide information and obtain consent for all cookies? No – PECR has two exemptions to the cookie rules. Regulation 6(4) states that: (4) Paragraph (1) shall not apply to the technical storage of, or access to, information - (a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. """ Strictly nessesary includes "Cookies that help ensure that the content of a page loads quickly and effectively by distributing the workload across numerous computers (this is often referred to as ‘load balancing’ or ‘reverse proxying’)". That covers at least one of the Cloudflare cookies directly, and gives good indication that the other two also qualify.
      - 6y ago

Naively did not realise using cloudflare as a cdn meant subjecting users to cookies. I don't have a consent banner... Does Netlify?

by Jsharm 6y ago

Naively did not realise using cloudflare as a cdn meant subjecting users to cookies. I don't have a consent banner... Does Netlify?

deleted 6y ago

[deleted]

donbrae 6y ago

Netlify doesn't seem to have a consent banner but sites hosted on it don't set cookies, despite using Cloudflare (at least that's my experience hosting a blog on it).

iruoy 6y ago
Netlify doesn't use cloudflare. Their DNS[1] is managed by NS1 and they host their websites on the edge[2] instead of using a cdn. [1]: https://ns1.com/blog/netlify-leverages-ns1-to-improve-performance-across-60-000-sites https://ns1.com/blog/netlify-leverages-ns1-to-improve-perfor... [2]: https://www.netlify.com/products/edge/ https://www.netlify.com/products/edge/
- donbrae 6y ago
  Ah, thanks. Didn’t realise that.

wongarsu 6y ago

At least under EU cookie laws and GDPR you shouldn't need a consent banner for Cloudflare cookies, as they provide essential functions (for availability and security) and don't track users. You might have to mention them and their purpose in your privacy policy though. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies https://support.cloudflare.com/hc/en-us/articles/200170156-U... goes in some detail what the cookies do and (more importantly here) what they don't do.

ancymon 6y ago
You might be kind of wrong. I think you don't need consent. But the cookie law still requires notification banner (which is basically the same thing). That's because cookie usage by itself (no matter the purpose) requires notification.
- ATsch 6y ago
  https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... Here's what the UK Regulator says. It's a bit unfortunate, there was a follow-up to this law that much improved the cookie nagging, but unfortunately it seems to have been stopped in it's tracks by lobbyists because of its restrictions on ad tracking.
  - deleted 6y ago
    [deleted]
  - wongarsu 6y ago
    Following the link from there to https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules1 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... you find this paragraph: """ Are we required to provide information and obtain consent for all cookies? No – PECR has two exemptions to the cookie rules. Regulation 6(4) states that: (4) Paragraph (1) shall not apply to the technical storage of, or access to, information - (a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. """ Strictly nessesary includes "Cookies that help ensure that the content of a page loads quickly and effectively by distributing the workload across numerous computers (this is often referred to as ‘load balancing’ or ‘reverse proxying’)". That covers at least one of the Cloudflare cookies directly, and gives good indication that the other two also qualify.
    - 6y ago