Why do websites ask about cookies? Because the law in Europe says a site must get a reader's consent before it stores certain cookies, and the question is how a site gets that consent. Many sites show the same question to everyone, in every country, because it is simpler than working out who is reading. The ad service vlvd ads takes a different route: it sets no cookies on the people who see its ads, so the ad itself gives a reader nothing to agree to.
The rest explains what a cookie is, which cookies need the question and which do not, and what a site is really asking when it shows the banner.
What a cookie is and what it was made for
A cookie is a small piece of data that a site stores in the reader's browser, and the browser sends it back on the next request. The Wikipedia entry on HTTP cookies says they were first introduced so users could record items they wanted to order as they moved through a site, a virtual shopping cart.
That use is plain and useful. Without a cookie, a site cannot tell that the person who put a book in the cart is the same person who now clicks to pay. The cookie carries that thread from one page to the next.
Why do websites ask about cookies? The consent rule
The question exists because of a rule in the ePrivacy Directive. The Wikipedia entry on the ePrivacy Directive says a 2009 amending directive changed Article 5, paragraph 3. Before the change, users had an option to opt out of cookie storage. After it, consent has to be obtained for cookie storage.
The entry adds that the meaning of consent is tied to European data protection law, and later to the GDPR. The HTTP cookie entry puts the result in one sentence: European law requires all websites targeting European Union member states to gain "informed consent" before storing non-essential cookies on a reader's device.
So the banner is a site's way of recording that it asked. A site that ignores the rule cannot show it asked. A site that asks has something to point to.
Which cookies need the question
Not every cookie does. The ePrivacy entry says cookies that are strictly necessary for delivering a service the user requested are exempt, and its example is the cookie that tracks the contents of a shopping cart. The cart cookie is the reason the reader is there, so no question is needed.
The cookies that do need the question are the ones the reader did not ask for. The HTTP cookie entry says tracking cookies, and especially third-party tracking cookies, are commonly used to compile long-term records of individuals' browsing histories. The same entry says that information in many cookies counts as personal data under the GDPR and needs a legal basis to process.
Where advertising comes in
Advertising is why the banner is so common. The HTTP cookie entry defines a third-party cookie as one that belongs to a domain different from the one in the address bar. It typically appears when a page features content from external sites, such as banner advertisements.
That arrangement opens the potential for tracking a reader's browsing history, and the entry says advertisers use it to serve relevant ads to each person. When an ad company places banners on two sites and sets a cookie through each, it can follow the same browser from one site to the other.
The worry is not new. The entry says that in February 1996 the working group behind the cookie specification identified third-party cookies as a considerable privacy threat. The specification it produced, RFC 2109 in February 1997, said they were either not allowed at all or not enabled by default.
A visit to a recipe site, step by step
An invented case shows where the banner comes from. Call the reader Dev. He opens a recipe site he has never visited, from a country in the European Union. The site is made up for this example.
- The page loads. Before showing anything else, the site holds back every cookie it does not strictly need.
- A banner asks Dev whether to accept cookies. The site needs his answer, because it also loads banner ads from an outside company that would set a third-party cookie.
- Dev declines. The recipe still opens, and the ad cookie is never stored.
- Dev adds a recipe to a saved list. The site stores a cookie to remember the list, which is the kind the exemption describes, so it asks nothing more.
The banner appeared because of the ad cookie, not the saved list. Take the ad cookie away and step two has nothing to ask about.
When a site has nothing to ask
That last point is why some ad services are built to set no cookies at all. According to its privacy page, vlvd ads gives people who see its ads no cookies and no visitor id. The sites tell it only their own name, the kind of ad wanted and which ads were already shown in this visit, held in the browser until the tab closes so the same ad is not shown twice.
It counts views and clicks per ad, per site, per day, as numbers only. Every ad, its picture included, is loaded from ads.vlvd.net, so advertisers never see who views their ad. With nothing stored about the reader and nothing passed to the advertiser, the ad part of the page leaves no cookie to ask about. Any cookie a site sets for its own reasons is a separate matter, and the rule covers it on its own terms.
Why the banners annoy readers
The ePrivacy entry notes that cookie consent banners, the pop-ups asking whether users accept cookies, are widely regarded as a nuisance. A reader meets one on almost every site, and each asks for a decision before the page shows its content.
The annoyance is a result of how the rule is carried out, not of the rule alone. One question per site, shown on every first visit, adds up. A site that stores fewer cookies has fewer questions to ask, which is the quiet argument for building ads and counting without them.
Frequently asked questions
Why do websites ask about cookies?
European law requires consent before a site stores cookies it does not strictly need, so many sites ask every reader. The banner records that the site asked.
Do all cookies need consent?
No. Cookies strictly necessary for a service the reader requested, such as a shopping cart, are exempt. The ones that need consent include tracking cookies and the third-party cookies set through ads.
What is a third-party cookie?
It is a cookie that belongs to a domain different from the one in the address bar. It typically appears when a page shows content from another site, such as banner ads.
Can an ad be shown without a cookie?
Yes. The page can state its own name and the kind of ad it has room for, and the service can pick an ad from that. Views and clicks can be counted as totals, so no cookie is involved.
Does declining the banner stop all cookies?
Not all. Cookies that are strictly necessary for a requested service are exempt from the consent rule, so a site may still store those.