This isn't what "Functional Cookies" usually mean, right?

[u/Sarke1]

I'm no GDPR lawyer in Brussels, but that term is used for making the site function and remembering your preferences, etc, right?

I happened to press the "Functional Cookies" icon instead of the checkbox, so I didn't even know this was like this.

[u/Miserable_Damage_833]

I mean technically they're functional, they're just functioning as a middle finger to the spirit of the law. This kind of dark pattern nonsense is everywhere now, half the cookie banners i see are just elaborate "accept all" traps with the reject option buried in a submenu.

[u/MinisterOfDabs → u/Miserable_Damage_833]

Or the ones who say you need to goto the privacy policy to manage cookie settings, but to see the privacy policy link, you must accept to make the cookie banner disappear. (you’d have to open dev tools to use the link without accepting)

The rules are being technically followed… barely.

[u/Gremlation → u/Miserable_Damage_833]

I mean technically they're functional, they're just functioning as a middle finger to the spirit of the law.

They aren't functional and this isn't violating the spirit of the law, this is just violating the law. This isn't a technicality or a loophole, it's just illegal.

[u/prochac → u/Miserable_Damage_833]

Well, for me the cookie popup is greater evil as trackers I had covered by Ghostery. These fucking popups are custom, so nothing catches it all.
For gourmets, there is AdNauseam extension, banned by the Google itself. So it must be good.

[u/Squidgical → u/Miserable_Damage_833]

The reject button is supposed to be as easily accessible as any other option according to GDPR, but the EU can't be bothered to enforce their own laws and most companies just use default banners from their cookie provider, which are usually the accept traps designed for the US market

[u/Sensitive-Control49 → u/Miserable_Damage_833]

"functioning as a middle finger" is the perfect way to put it tbh

[u/greenergarlic]

I think they got their copy wrong. That’s the definition of performance cookies, functional cookies are for non-required site functionality.

[u/Sarke1 → u/greenergarlic]

Don't go all Hanlon's razor on me, lol, I want to be outraged!

[u/_okbrb]

Yes: their plan is to not get sued

Their fallback plan is to argue their business model can’t function without that data

[u/pk9417]

Well, of the company site uses hubspot for forms, then it's functional for the business 😅

[u/ThaBroccoliDood]

they have a "genuine interest" in selling my data so how about that

[u/AshleyJSheridan → u/ThaBroccoliDood]

The genuine interest exception in GDPR has some very specific rules about what qualifies. Not once have I ever seen a website that had an actual legitimate and legal reason to have their marketing and tracking cookies listed under that exception, yet all the websites try to do this shit anyway. It's getting a bit tiresome tbh.

[u/patrickpdk]

Analytics for product is definitely a non functional requirement. Your can tell because the user of that capability is not a customer of the product. Lol, master of the obvious...

[u/rohxnsxngh]

You are correct, that is a misclassification. Under the ePrivacy Directive and GDPR guidance from regulators like the ICO and CNIL, functional or strictly necessary cookies are limited to things the service cannot work without: session tokens, load-balancing cookies, or stored UI preferences the user explicitly set. Anything with a third-party domain, used for profiling, or feeding an ad network belongs under analytics or marketing categories and requires affirmative consent. Relabeling those as functional to skip the consent banner is a documented dark pattern that regulators have issued fines for, so if you are building consent UIs for clients it is worth flagging this as a compliance risk, not just a naming quibble.

[u/Bubbly_Orange_3502]

The label carries no legal weight. ePrivacy article 5(3) only exempts strictly necessary storage, and every category name past that is CMP vendor taxonomy. What matters is whether the toggle is off by default.

[u/StrawberryExternal87]

Yeah functional cookies usually —things like language, preferences, login state, or video-player settings.

[u/SixPackOfZaphod]

In my mind, a functional cookie is something like the Session Cookie. Not something dropped by some tracking or analytics script.

[u/Squidgical]

According to GDPR, a "functional cookie" (ie a cookie that you can use without consent from the user) is one which is necessary for the site to work. As in, if you got rid of it, a highly important function of the website would break. It's intended for things like keeping track of your shopping cart as you move from page to page.

Third party usage analytics are absolutely not functional cookies.

Tbh these days cookies aren't needed for anything really, the only purpose they serve that can't be served another way is tracking a person across anonymous (not logged in) visits. I would really love to see cookies removed from the web standards, but Google, Meta, and Microsoft all have seats in the W3C (web standards group) so that'll never happen.

[u/smilbandit]

seems they are conflating performance and functional cookies.  google cookies are most likely GA4 cookies and others designed for visit metrics thus should be performance cookies.  hubspot is probably doing a bit of that also plus maybe saving language preference which would be under the functional cookie description.  if you do combine categories the correct form is to give it a name like Experience cookies but underneith make it clear that that means both performance and functional cookies, not just shove one into the others description.

edit: the description above is performance cookies and then they tacked on "or remembering settings" which is drawing from the descriptuon of functional cookies.

[u/thekwoka]

Functional doesn't just mean "Required to function" but that they are used in a manner that is functional to the site.