alt Hacker NewsThis is actually slightly narrower exception than people (and regulators) think. The exception is:
> strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
One very ignored qualifier here is "information society service". This is defined in Directive 2015/1535 and one of the requirements is that the service is "normally provided for remuneration". That is usually understood to mean that the service needs to be tied to provider's economic activity. This effectively excludes, for example, public authorities websites which are for their own public duties. It does however include e.g. ad supported websites.
And yes, I'm aware that many national implementations actually miss that qualifier. That can save the non-commercial private sector websites, but public authorities do not benefit from Member States failing to transpose Directive correctly.
What I hate about EU laws is they tend to word these things like this.
People act shocked when it leads to unintended side effects, but companies legal teams are just telling them they have no idea how a judge will interpret these broad wordings in regards to their business.
People say this fixes "future loopholes" but as you see with the cookie banner, it just leads to every company assuming the worst case scenario.
Going back years of conversation on cookie banners you'll see a constant argument on when they're required or not precisely because it's not defined explicitly.