A widget with no cookies still stores something
We set no cookies, and that is a smaller claim than it sounds.
Last updated
What a widget actually writes
Nothing reaches document.cookie — not from the file your page downloads, not from the changelog loader, not from anything a customer can build. What a widget does write is a small flag in the visitor's own localStorage under a `ke:w:` prefix: that they closed the bar, which updates they have read, which step of a walkthrough they reached. None of it is sent anywhere. There is no request carrying it, and no row on our side it could be joined to.
Why that is still Article 5(3)
The ePrivacy rule everybody calls the cookie law is not about cookies. It is about storing information on, or reading information from, a user's terminal equipment, and local storage is squarely inside that. The exemption is for storage strictly necessary to deliver a service the user explicitly asked for. Remembering that somebody closed a bar so it stays closed looks to us like that exemption doing exactly the job it was written for, and an identifier that followed them between sites plainly would not. We think the first describes what we do, but this is our reading, not legal advice.
What the absence of cookies does buy
No identifier that outlives the tab. Nothing shared with a third party, because there is no third party in the request path. No visitor table here to be the subject of an access request, because none was ever written. And, the practical one: a widget that cannot be the reason a site needs a consent banner it did not need the day before.
Where we would not defend the claim
The moment you use a widget to ask somebody for an email address, that is personal data and you are the one who needs a lawful basis for holding it. The mechanism is boring and the content is not. Our claim is about what the code does on its own; it says nothing about what you decide to ask people to type into it.
What this is evidence from
- Directive 2002/58/EC (ePrivacy), Article 5(3), as amended in 2009, from
- the rule this is written against, and the date Member States had to be applying the amended consent requirement by
- 0 cookies
- set by the files a customer's page loads, counted from the shipped bytes by a test rather than promised in a sentence
public/widget.src.js- the renderer itself, where the per-visitor flags are written and where a test checks that document.cookie is never among them
lib/schemas/widget-guarantee.ts- why storing a dismissal flag is deliberately not a fifth claim in the guarantee record, since no widget has ever stored nothing