19

What is the script being fetched from cdn.cookielaw.org when I open the cookie settings dialog? What is it for / what does it do / why is it needed?

Following the update in Update to our Advertising Guidelines, I wanted to sanity-check my cookie settings and found that I had to unblock cdn.cookielaw.org in my /etc/hosts file to be able to open the cookie settings page.

Also, strangely, after I finished my sanity check and blocked that domain again, I could still open the cookie settings dialog. Why?


I tried googling site:meta.stackexchange.com "cdn.cookielaw.org", and the best I got was https://meta.stackexchange.com/a/363872/997587 (and yes, I did get the error toast message, but didn't think to save it, and can no longer reproduce as I stated above) and https://meta.stackexchange.com/posts/comment/1206821.

2 Answers 2

12

When I click "Cookie Settings" in the footer, two scripts are loaded:

  • otSDKStub.js
  • otBannerSdk.js

They're both indeed served to your browser from the cdn.cookielaw.org domain (which is why they were blocked), but they also carry hints pointing to another company– OneTrust (the parent of the company behind Cookie Law, as pointed out by staff member @Sasha in a comment and easily confirmed).

If you open the scripts themselves, both of them mention "OneTrust" near their start (and both filenames begin with "ot"):

otSDKStub otBannerSdk
Beginning of otSDKStub JS file, which begins with declaring a variable named "OneTrustStub" The beginning of otBannerSdk JS file, which contains a commented title of "onetrust-banner-sdk"

A quick search identifies this company as "a privacy and security software provider" (so says Wikipedia).

It seems like OneTrust does a lot of different things, but one of them is provide templates for cookie banner dialogs (they have an entire page devoted to previewing some various template options).

While I don't intend to dive into the technical details of either script in depth (both are pretty big!), based on the above it seems like both of them are imported to support showing the cookie dialog itself, and helping Stack Exchange effectively manage your cookie settings as required by applicable law.

@Sasha's comment also calls out that this change is part of the recent rollout of the updated cookie consent dialog described in Update to cookie consent modal for EU/UK users, which makes a lot of sense in terms of timing (I'd also speculate that this is the motivation behind removing per-site stylings for that dialog). Despite the verbiage change being exclusive to UK/ EU users, the backend vendor for that dialog has changed– hence, the new script being pulled for all users (regardless of location).

In terms of being able to reopen the dialog after re-blocking the domain– that's probably caching; since your browser already downloaded the script once, unless that cached JS script expires (or you manually clear it), it will continue to function even after blocking the domain.

4
  • 1
    thanks. I knew about OneTrust but not about the template thing. I had a feeling about caching but previously ruled it out since I assumed the hosts file would apply to cached requests, but upon some further thought, this makes sense if the caching is a browser-level thing, and skips the network request, which would be an OS-level thing like the hosts file. shame I didn't realize earlier. I was doing it in a browser profile that had network caching disablement disabled in devtools (I usually disable it, but that profile is newer) Dec 13, 2023 at 17:54
  • 8
    This answer is correct. As part of the Update to Cookie Consent Modal changes, we are starting to use our vendor OneTrust (owner of cookielaw.org) to deliver the cookie modal.
    – Sasha StaffMod
    Dec 13, 2023 at 20:51
  • 1
    @Sasha that announcement says the change is only for EU/UK users, but does the fetching of web resources (and the failing of the dialog if that fetching fails) from cookielaw.org apply for all users? or only for those in the EU/UK? Dec 13, 2023 at 21:24
  • 3
    @starball The regulatory requirements in the EU/UK inspired this new approach, but the fetching change itself applies to all users regardless of location. Sorry if that was not clear.
    – Sasha StaffMod
    Dec 13, 2023 at 21:40
6

When in doubt, just browse to the source! ;)

The Cookie Law is a piece of privacy legislation that requires websites to get consent from visitors to store or retrieve any information on a computer, smartphone or tablet.

It was designed to protect online privacy, by making consumers aware of how information about them is collected and used online, and give them a choice to allow it or not.

So essentially, a third party provider for the stuff related to consent.

All in all, seems harmless enough.

6
  • huh. interesting that my template hosts "blocklist" blocks it then (relevant discussion)... still, this doesn't answer what that script does. Dec 13, 2023 at 9:53
  • @starball you mean technically? Guess I can dig into this, but probably storing the preferences for them or something like that. Dec 13, 2023 at 9:55
  • 7
    @starball seems that the page you linked already explains why they block it and tangentially why Stack is failing. See StevenBlack post "I would like to make one thing clear to everybody. If a website uses CookieLaw, and their website fails to load or deliver if CookieLaw is not responding, this is their problem, not ours. In other words, if a website fails to work because they rely on CookieLaw, we're not gonna whitelist CookieLaw because of a CookieLaw customer's abject stupidity."
    – SPArcheon
    Dec 13, 2023 at 10:15
  • 1
    "third party provider is harmless" is a statement that requires a source. In fact, GDPT requires explicit customer consent for SO to share my data (including cookie preferences) with a third party.
    – Gloweye
    Dec 13, 2023 at 12:47
  • 1
    @Gloweye I mean this specific one, in the context of what they're doing, not the general case. Dec 13, 2023 at 13:17
  • 2
    @SPArcheon it actually doesn't really explain why they block it. In SE terminology, it's not an answer. It's just a "go figure it out on your own and you'll see". I've asked the primary maintainer of the project if they can elaborate. Dec 13, 2023 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .