Hacker News Reader

Comment by TheCapeGreek | Hacker News Reader

To give the benefit of the doubt, knowing nothing else about this company:

This is clearly a South African based company. GDPR and cookie may be important compliance but it's not top of the totem pole - the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations.

I've even noticed some sites serve different forms of cookie consent depending on where you're accessing from. I only started seeing the ability to reject cookies entirely when I travelled to EU recently - before it was always hidden in dark pattern UX.

View on HN

GDPR is also nothing about cookies. It is about collecting tracking and marketing data about someone without their permission.

If you do any tracking and you don't use cookies, you still need permission and if you use cookies but you aren't using them for data mining then you do not need to ask for permission.

> the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations.

The GDPR is exactly the same. Even the ePrivacy Directive (the so-called "cookie law") actually covers more than just cookies - any method of storage in a user's terminal (whether browser local storage, or an app's own database) is also in scope.

Indeed, and you can also use cookies without requesting permission.

For example, a login cookie is “essential” and does not require consent

But don't start that php session (which sets the session cookie) before the user sends login credentials.

You are allowed a session cookie if it is for the operation of a website.

You don't need to ask permission to store a shopping cart or anything like that as a cookie.

I agree, it's not necessarily only login credentials, but could be a shopping cart. However, no shopping cart is needed until the user adds an item to it. Watching the shopping window doesn't need a cookie.

The typical practice seems to be to set a session-cookie unconditionally, to be able to store user-related data within that session, even if the user has not provided any such information.

Are you using that cookie for tracking or analytics?

If not then that's fine.

It's not, it's a Dutch company

The Dutch colonized South Africa again eh? Old habits die hard.

No it’s not, why would you claim it was? The domain TLD is South African (.co.za), the phone number listed is in Cape Town, and it’s a South African registered company.

> Voys Telecom SA (Pty) Ltd A company with limited liability duly incorporated in terms of the Companies Act of South Africa, 71 of 2008, with registration number: 2013/114285/07, hereinafter referred to as “the Service Provider”;

https://www.voys.nl/ exists

Ah, got it. Yup, the Dutch office is the original one, there are a bunch of others around the world.

As far as I can tell though each different country office operates largely independently, almost as a franchise. So it might still be that the South African branch, with a registered local entity and no EU-based customers is more focused on POPI than the GDPR.

We're an international telco, with two separate local entities & local teams, that are governed by different laws. The voys.nl website most certainly has the cookie consent screen.

Reply on news.ycombinator.com