GDPR cookie compliance
Closed this issue · 5 comments
hemebond commented
- If no consent cookie then no other cookies should be set
- If consent cookie is missing or declined, then no forms, which require a CSRF cookie, should be presented to the user
- If no consent cookie then all pages with forms (and hence CSRF tokens) should include a modal asking for consent, and reload the page on selection
hemebond commented
No cookies should be set until the user has granted or declined consent to set cookies. Re-opened with new tasks.
SpiritQuaddicted commented
Brrrr, so complicated and overkill for sites like this. Maybe there is some Django add-on that does it?
hemebond commented
I'm going to remove it completely. The site does not use any non-essential or third-party cookies so a banner or warning is not required.
SpiritQuaddicted commented
Are you 100% sure about that? To my knowledge being restricted to first-party cookies does not remove the need for consent (or information at least).
hemebond commented
Yip. Quaddicted only uses functional cookies (sessions). Github just removed their cookie banner for the same reason.