I didn't think the cookie law is actually an intrinsic part of GDPR
Because it is not. [1] It was part of the ePrivacy directive, it has been amended since. The TL;DR is: today, if you don't use cookies for tracking and/or ads, you're fine. Just put a cookie consent checkbox on the user login form, and your website will have a much nicer user experience.
If you show a cookies consent modal before your visitors can access anything, either:
* you have personalised ads with global tracking. (~= criteo, amazon ads, or google adsense)
* you're using a globalised analytic tool. (~= Google Analytics)
* you're following an outdated version of the ePrivacy/GDPR directives.
They say you don't need cookie consent for login form. Login form is an obvious authentication, opt-in even. You need cookie consent when you authenticate user stealthily - how Google Analytics does it.
Comments
Because it is not. [1] It was part of the ePrivacy directive, it has been amended since. The TL;DR is: today, if you don't use cookies for tracking and/or ads, you're fine. Just put a cookie consent checkbox on the user login form, and your website will have a much nicer user experience.
If you show a cookies consent modal before your visitors can access anything, either:
* you have personalised ads with global tracking. (~= criteo, amazon ads, or google adsense)
* you're using a globalised analytic tool. (~= Google Analytics)
* you're following an outdated version of the ePrivacy/GDPR directives.
But it's easier to blame it on the EU.
[1] https://gdpr.eu/cookies/
They say you don't need cookie consent for login form. Login form is an obvious authentication, opt-in even. You need cookie consent when you authenticate user stealthily - how Google Analytics does it.