Are Paddle's Cookies GDPR Compliant?

I think I last contacted them about this issue about 2 months ago.

One of GDPR's prime motivations is to give people options around how their data is obtained, used and removed. GDPR calls out some specifics about what it considers identifying a person (e.g. I can link it to a living person using that information). Therefore things like IP address or building a profile using remarketing techniques falls into the specific of "personal data".

So in the instance of Paddle, they are potentially using tools like Hubspot, facebook, etc to create profiles. They should be asking people visiting their site for consent before they begin capturing it and processing their personal data.

The requirement for a "Cookie Consent modal" comes from the EU's ePrivacy Directive, not GDPR. They are linked, in fact a new version is on the way to better align them, but they aren't doing the same thing. For "cookie compliance" you need to

• Receive users’ consent before you use any cookies except strictly necessary cookies.
• Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
• Document and store consent received from users.
• Allow users to access your service even if they refuse to allow the use of certain cookies
• Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

However, different EU privacy regulators have taken slightly views on cookies, which is one of the reasons why the ePrivacy Directive is getting a rewrite. Last time I looked the UK says analytics are fine without consent, FR says absolutely none without consent first, etc.

In the instance of Dapple, I use the browsers "Do not track" policy for any analytics systems (e.g. Hotjar), note that and list them out in the terms and conditions*. Since I'm not using any remarketing stuff, just analytics I believe I fall into the "necessary cookies" category.

After all that tho, if you're in the US and not really targeting EU people, theoretically you shouldn't worry about GDPR too much. Unless of course you plan on setting up shop in the EU soon.

*Although I've not realised I've screwed up a release that should have updated the T&Cs (thanks for helping me find that!)

GDPR only requires sites to seek permission for cookies that record personally identifiable information (PII). Google Analytics does very much do that, so users must give their consent. Cookies that are solely concerned with site functionality, e.g. the "have I seen the cookie notice dialog?" cooke are not required to be covered in the privacy statement or have prior permission sought. Which, if you think about it makes sense: if you can't show someone a dialog asking for their cookie permission without first showing them a dialog to ask for their cookie permission, then you would have a infinite sequence that the user could never finish answering!

It means, that the cookies you listed were created by you visiting other pages.
It has nothing to do with GDPR. I am just explaining that your assumption that Paddle creates these cookies the way you described is wrong.