Hello everyone,<p>I am not an expert in all things cookies and session data and all that stuff. But I have recently stumbled upon something that seems quite off... If I visit YouTube I get greeted with the choice to log in or not. If I click "no thanks", I am prompted with a choice of either accepting Google using cookies or leave the website. In theory, my logic says that if I now leave the website, the next time I visit it, I should be greeted again with the same prompt since I have not accepted any cookie being stored. That does not happen. If I then take a look at the Session cookies that were stored, I see a Youtube cookie with the following information stored: CONSENT:"YES+CH.en+V9+BX". I am not sure if this is the consent to them storing cookies or what, but only if I delete this cookies, I get prompted again to log in or accept the terms. Seems kind of weird that they store cookies before you accept them storing cookies...<p>Did I find something here or is it just how it works?<p>Thanks!
Under the hood (legally) there is no ban on cookies per se. It is rather on tracking of personally identifiable information. It is Ok to place a cookie without explicit permission if it tracks something that can be applied to a wide range of people, like a timezone or language perference, for example.
Google/youtube has figured out my work and personal accounts are the same person. I always log in to those accounts from separate work and personal machines but I do forward some mails and calendar events sometimes.<p>You can tell it has you figured out when your Youtube recommendations on one box account begin to reflect the watch history on another account.
Assuming you're living in the EU.<p>The cookie:<p>So on the one hand there's the GDPR which deals with personal data (PII). As what they're storing there does not seem to be PII and is not used for tracking you, it does not care.<p>On the other hand there's the EU cookie directive. It is responsible for all the "this website uses cookies" banners from before the GDOR Consent popups. I'm not sure if it forbids storing any cookies wihtout consent but that's a direction you might want to look at in more detail. <a href="https://www.privacypolicies.com/blog/eu-cookie-law/" rel="nofollow">https://www.privacypolicies.com/blog/eu-cookie-law/</a><p>Can't say much about the consent form itself as I think the google consent form is especially weird as it's not possible to deny them tracking and still use their site. I suspect there will be fines for that some time down the road, but there a probably a lot of smarter people than me looking at this so what do I know...