No, it doesn't. If it's reasonably expected as part of the service, you don't need to gather consent. It's not even personal data.

The law does not say 'reasonably expected', it says 'strictly necessary'.

Sorry, getting my GDPR and e-privacy terms mixed up. The cookie is strictly necessary for the setting to be saved. The user has specifically requested that the setting be saved by changing it. The opinion suggests this should be a session cookie unless you indicate somewhere prominently next to the setting that it uses cookies to store it for longer. This still doesn't require a cookie banner.

What's more, if the 'cookie' is entirely local (i.e. it's never sent back to your own server, e.g. you're using the local storage API and the javascript on your page never puts that information into a request), like how this would normally be implemented nowadays, then these requirements don't apply at all (because a cookie according to the law is just something your server gives to the user's device and then the device gives back later).

Okay, but it doesn’t require notification for every user that hits your landing page.

If you want to remember dark mode with a cookie, then you can just gate that setting behind a “allow functional cookies” toggle.

Getting consent for functional cookies doesn’t have to be done with an intrusive cookie bar on landing. You can request consent as it becomes needed. There’s other ways of complying that aren’t dark patterns.

Can you please tell me what part of this law requires any sort of notification or toggle whatsoever for remembering your dark mode setting: https://gdpr-info.eu/art-6-gdpr/

You're replying to me, but I'm not the one asserting it. The GDPR law doesn't require it specifically, but the earlier ePrivacy regulation does and it is considered to be the guide for GDPR on this specific issue. Lex Specialis is the term for one regulation being applied within a different one.

In any case here is a plain text interpretation from the EU (https://gdpr.eu/cookies/):

"Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.

Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in."

Farther down:

"To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

Receive users’ consent before you use any cookies except strictly necessary cookies. ..."

So a preference cookie is categorized differently than "strictly necessary" by the ePrivacy rules predating, but now part of, GDPR. But elsewhere in this thread someone asserted that a cookie that is placed and the data never sent back to the server is exempt, so if you handle dark mode entirely client side you might be ok?

I'm beginning to understand why the lawyers in the EU just say "fuck it, put a banner up"

I thought GDPR replaced ePD. Are you saying it did but specific things like how you should ask for consent carried over?

I’m not your personal lawyer, and your tone is abrasive elsewhere.

Google “lex especialis eprivacy GDPR”.

OK, so don't do that. Web sites work fine without remembering anonymous users' preferences across sessions.

Can you point to the law in question?

Nonsense.

You are correct that people keep stating such things. But it is incorrect.

That example would be an essential cookie, also known as a strictly necessary cookie.

A shame this FUD is still being spread.

That's not what various references (and AIs) say. Strictly necessary means strictly necessary. They didn't bother defining it in the law. However, user preferences were called out specifically in the WP29 opinion as something that wouldn't count as strictly necessary if scoped any wider than the browser session. So if the plain English meaning and the drafters' opinion contradicts your opinion, why should I risk significant fines to trust it?

Yeah well most references on this are wrong, and AIs are doubly wrong since they ingest those references and also since they are AIs.

I suggest actually reading the GDPR if you think it applies to you. The EU put it up on a website for everyone to see. Here's the most relevant section: https://gdpr-info.eu/art-6-gdpr/

Notice how cookies are not mentioned, popups are not mentioned, and strictly necessary is not mentioned. Those are requirements the data harvesting industry invented out of whole cloth. They are not the actual requirements.

I'll just repeat that one more time: the GDPR does not mention cookies or popups. Let that sink in. It's all cargo-cult.

The GDPR also doesn't give a shit about dark mode preference. Literally nothing in it has any relevance to a dark mode preference, even (and especially) if you store it in a cookie.

See my other response with citations.

In short: the GDPR doesn't mention it but it is covered by the ePrivacy directive/regulations which does cover cookies very specifically, and which is enforced through GDPR.

What does "enforced through GDPR" mean here? That if you don't ask permission for saving a dark mode preference, they'll fine you for misuse of personal data even though it isn't personal data and you're not misusing it?

You read and replied to my other response. It answers this question and gives you the laws you demanded and the terms to research the answer to this question.

Have a good day.