GDPR Compliance: Do all Cookies require Opt-In?
<p>Given a Web Site which uses cookies for the following:</p>

<ul>
<li>User Preferences</li>
<li>Bookmarked Articles</li>
<li>Cookie Preferences</li>
</ul>

<p>what explicit permissions would be required from the user?</p>

<p>Here I anticipate the cookies would be set from JavaScript, so no identification of the user would be required. I know that cookies are sent to the server.</p>

<p>Not all cookies require consent.</p>
<p>The current answers are in <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf" rel="noreferrer">WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194</a>.</p>
<p>This WP29 Opinion is based upon Directive 2002/58/EC (&quot;ePrivacy Directive&quot;), and not GDPR, which is current law for this matter until other guidelines are adopted pursuant to GDPR or until the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52017PC0010" rel="noreferrer">awaited &quot;ePrivacy Regulation&quot;</a> is finally adopted.</p>
<p><strong>1. General rules</strong></p>
<p>This Opinion states 2 critera for cookie consent exemption:</p>
<blockquote>
<p>(...) exempted from the requirement of informed consent, if they
satisfy one of the following criteria:</p>
<p>CRITERION A: the cookie is
used “for the sole purpose of carrying out the transmission of a
communication over an electronic communications network”.</p>
<p>CRITERION B: the cookie is “strictly  necessary  in  order  for  the  provider
of  an  information society service explicitly requested by the
subscriber or user to provide the service”.</p>
</blockquote>
<p><strong>2. User preferences</strong></p>
<p>The first two types of cookies would be, as I understand, for the purpose of remembering user preference in how it interacts with the Website. Such types of cookies can fall under criterion B, under certain conditions.</p>
<p>Section 3.6 &quot;UI customization cookies&quot; explains the conditions that such type of cookies have to meet so that the consent exemption can apply, in particular:</p>
<blockquote>
<p>User interface customization cookies are used to store a user’s
preference regarding a service across web pages and <strong>not linked to
other persistent identifiers such as a username</strong>. They are <strong>only  set</strong>
<strong>if  the  user  has explicitly  requested  the  service  to  remember</strong>
a  certain  piece  of information,  for  example,  by  clicking  on  a
button  or  ticking  a  box.  They  may  be  <strong>session cookies</strong> <strong>or</strong> have a
<strong>lifespan counted in weeks or months, depending on their purpose</strong>.</p>
</blockquote>
<p>(...)</p>
<blockquote>
<p>These customization functionalities are thus explicitly  enabled by
the user of an information society  service  (e.g.  by  clicking  on
button  or  ticking  a  box)  although  <strong>in  the  absence  of</strong>
<strong>additional  information</strong>  the  intention  of  the  user  could  not  be
interpreted  as  a  preference  to remember  that  choice  for  longer
than  a  <strong>browser  session</strong>  (or  no  more  than  a  few  additional
hours).  As  such  <strong>only  session  (or  short  term)  cookies</strong>  storing
such  information  <strong>are  exempted</strong> (...).  The  addition  of  additional
information  in  a  prominent  location  (e.g. “uses  cookies”
written  next  to  the  flag)  would  constitute  sufficient
information  for  valid consent to remember the user’s preference for
a longer duration, negating the requirement to apply an exemption in
this case</p>
</blockquote>
<p>If you need to request consent, then <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2013/wp208_en.pdf" rel="noreferrer">WP 29 Working Document 02/2013
providing guidance on obtaining consent for cookies - 1676/13/EN WP 208</a> contains guidance.</p>
<p><strong>3. Cookie Preference cookie</strong></p>
<p>The last type of cookie you mention, being the Cookie Preference cookie, would be, as I understand, only used as a purely technical mean to store and retrieve (transmit) the user's explicit choices preferences, and would most probably fall clearly under criterion A and/or B.</p>

gdpr website