Required entry for cookie consent

[PlasmaHH]

Our law department says that for the cookie consent dialogue we need one option for "necessary" information that cannot be unchecked (as per their definition the local storage that mkdocs uses counts here too).

Is there any easy direct way to achieve that with a setting? I know I could hack the consent.html to add that somehow....

Intresting fun side fact:

I asked some AI assistent and it claimed there to be a "required" setting and it claimed there to be one, implemented in consent.html and even proceeded to show me some code:

It even claimed that it came from a commit 0c2e855 which doesn't seem to exist, so I wonder where it got all this from, maybe this is from the insiders code and the AI training process somehow found a way to access that?

[squidfunk]

There is no required setting, but you might adjust the template and add the disabled attribute to the specific checkbox. Note that some users might consider this being a dark pattern, so maybe it's a good idea to talk to your law department again.

[PlasmaHH]

IANAL but they say to be fully GDPR compliant you have to include local and session store too, its not about what is transmitted but what is stored accessible for the website code...

[squidfunk]

Okay, note that those settings might be stored prior to the user accepting the cookie consent, so technically, you might be already in breach if session storage is considered a problem. However, it's nothing that can be remotely considered personal data. You cannot infer who somebody is by the choice of their palette or tabs, or whether they dismissed an announcement bar. It just makes no sense to put this in the cookie consent, as it is not even a cookie, and thus not sent with the request.

Disclaimer: I'm not a lawyer. However, I would love to see by what law or ruling this is backed. It just makes no sense.

[PlasmaHH]

Same for me, I think this might be a case of the sphere of knowledge of lawyers and it people having a too small overlap. One can uniquely identify people in most cases via browser fingerprinting anyways. In corporate environments these things are sometimes out of control of the poeple that have to implement it sadly....

[squidfunk]

Sadly, I can relate. I just wanted to point out that it's logically not a problem, but I understand the defensive approach.

[squidfunk]

One alternative suggestion to your problem: instead of adding a required consent, you could just adjust the text of the consent so that it reflects the use of local storage for preferences like palette or tabs. Less work for you with the potential for the same outcome, since you'll likely need to explain why one option is not deselectable. Something like:

By accepting the cookie consent, you allow the site to store viewing preferences on your computer ...

Just an idea.