Question 1

What is a cookie banner legally required to do?

Accepted Answer

Obtain **valid consent** before storing or accessing non-essential information on a device — and most cookie banners do not meet the standard, which is why regulators across Europe have issued repeated enforcement decisions about them.

**The legal basis.** In the UK, the **Privacy and Electronic Communications Regulations (PECR)** govern storing and accessing information on a device, with the **consent standard taken from UK GDPR**. So the question is not whether a banner exists but whether the consent it obtains is valid.

**What valid consent requires:**

**Freely given.** Not a condition of access where that is disproportionate.

**Specific**, by purpose — so bundling analytics, advertising and personalisation into one acceptance is inadequate.

**Informed**, before the choice is made.

**Unambiguous**, by clear affirmative action.

**As easy to withdraw as to give.**

**What is therefore not valid, despite being common:**

**Pre-ticked boxes.**

**Implied consent** from continued browsing — "by using this site you agree" does not work.

**Cookie walls** conditioning access on acceptance, in many circumstances.

**Setting non-essential cookies before a choice is made**, which a substantial proportion of sites do — the banner appears while the tracking has already begun.

**Making rejection harder than acceptance.** A prominent "Accept all" with rejection hidden behind several clicks in a settings panel is the single most enforced-against pattern. **Reject must be as accessible as accept**, which is why banners increasingly show both buttons together.

**Interface design pressuring one choice** — greyed-out reject buttons, emotive language, repeated prompting.

**What is exempt.** **Strictly necessary** cookies require no consent: those needed for a service the user has explicitly requested, such as session management, load balancing, and remembering basket contents. **Analytics is not strictly necessary**, however useful it is — this is settled, and is the exemption most frequently claimed wrongly.

**What good practice looks like:** equally prominent accept and reject; granular purpose controls; no non-essential cookies before consent; an accessible way to change the decision later; and a clear statement of what each category does.

General information, not legal advice.

Question 2

What is a subject access request, and what must an organisation provide?

Accepted Answer

A right of access under data protection law allowing anyone to ask an organisation what personal data it holds about them, and to receive a copy — and the scope is wider than most organisations

Question 3

What can a browser extension actually see?

Accepted Answer

Potentially everything you do in your browser — which makes extensions one of the most under-appreciated security risks on a personal computer. What a permissive extension can access: The content of

Question 4

Why do apps ask for so many permissions?

Accepted Answer

For a mixture of genuine functional need, defensive over-requesting, and data collection — and the three are difficult to distinguish from the request alone. Legitimate reasons: The feature requires

Question 5

What are the risks of scanning a QR code?

Accepted Answer

A QR code is simply an encoded string — most often a URL — and the risk is that you cannot read it before you act on it. That single property is what makes the format attractive to fraudsters. The

Question 6

What is a digital identity wallet?

Accepted Answer

An application holding verifiable credentials — cryptographically signed statements about you issued by a trusted body — that you present selectively, without the verifier needing to contact the

Question 7

Are electronic signatures legally valid?

Accepted Answer

In most jurisdictions yes, for the great majority of documents — the law generally does not require a handwritten signature, and the practical question is evidential: can you prove who signed, that

Related Questions