That tells you SO is doing not-strictly-necessary data analytics.

Which it admits directly when you click the cookie banner button labeled “Customise settings”: you are presented with four yes-no toggles, the first of which is labelled “Strictly Necessary” and which can’t be disabled.

IANAL but from what I’ve been told the SO banner isn’t even GDPR compliant because it makes it harder to reject unnecessary cookies than to accept all of them.

> That tells you SO is doing not-strictly-necessary data analytics.

That tells me that they don’t know. Making every part of the org prove that they aren’t is very expensive but doesn’t improve the service.

The customise settings popup has an always-on item literally labelled “Strictly Necessary”.

If they apply that as on and everything else in that popup as off, they are in compliance with GDPR without having to show the popup.

Unless that setting is misleading, but then they are not in compliance even despite showing the popup, even if they fix the problem I raised previously.