Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs.
Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookies.
By the same logic, are cookie violating if they are stored _somewhere else_ but the service provider are not selling those cookies to other people? what if the service provider have another service provider that provide analytic services to help with serving the website in question?
What's the difference of say, a dedicated cookie storage service company storing the cookie vs. an internal IT team that builds the wheel and store the cookie with analytic services? Especially when the usage of the cookie in both case being limited to the site in question?
This seem to negate the entire idea of programming - do one thing well, and have another thing to another thing well. Which applies to the business world at large.
Cookies aren't inherently against GDPR if they're used explicitly for necessary site functionality—you don't even need to tell users about them in that case.
So why display the cookie warning? I assume it’s an attempt to obtain “consent” to something that would otherwise be prohibited by the GDPR, and in relation to consent the GDPR says:
“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment ... Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.”
I agree with the grandparent that many cookie warnings seem at odds with the GDPR in this respect.
Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookies.