Guest blog: European regulators set up joint Cookie Banner Taskforce
Does your cookie banner meet the requirements?
Max Schrems is well known in the privacy protection world. To privacy campaigners, he's something of a hero, but many enterprises that handle personal data view him in a somewhat different light. A complaint made by Schrems led to the Privacy Shield (and its predecessor, the Safe Harbor Privacy Principles) being declared invalid, significantly complicating the processing of European personal data in the US.
Cookie banners often don't meet the requirements
Schrems has no plans to stop fighting to protect privacy. This year, he's focusing on compliance with the EU's cookie legislation. His NOYB foundation has submitted more than four hundred complaints about cookie banners to multiple data protection authorities, arguing that the banners don't comply with the General Data Protection Regulation (GDPR). Partly in response to the complaints, the EDPB (an association of European data protection authorities) has set up a Cookie Banner Taskforce. So this is a very good time for checking the compliance of your cookie banner!
Cookies, what are they again?
Cookies are small text files that websites and apps save on users' phones, tablets and computers, containing information that the app and site operators want recorded for future use. To understand how they work, consider the following 'analogue' scenario. You go to an electronics shop and spend some time looking at a laptop that you like. A shop assistant sticks a Post-it on your back saying that you're interested in the laptop. When you go back to the shop next day, the shop assistant checks out the Post-it as you come in, sees that you like the laptop and adjusts their sales patter accordingly. It's worth noting that, while the word 'cookies' is in widespread general use, the applicable legislation doesn't use that term. The rules that apply to cookies apply to all forms of digital tracking, including fingerprinting and the use of web beacons.
It that allowed?
Strictly functional and privacy-friendly analytical cookies are perfectly legal. However, the relevant legislation (in the Netherlands, the Telecommunications Act) says that all other cookies are allowed only with the subject's consent. And the consent arrangements have to satisfy certain criteria. Consent must be specific, informed, unambiguous and given freely. It must also be actively given. In other words, a notice saying that "by using this website you agree..." isn't sufficient. Furthermore, the user must be able to withdraw their consent at any time.
In summary, the key criteria a cookie banner has to meet are:
It must be possible for visitors to withhold consent (otherwise consent can never be considered freely given).
It must be clear what visitors are being asked to consent to.
It must be clear to visitors what will be done with their data if they do consent.
Consent must be actively given: non-objection doesn't amount to consent, nor does failure to untick a pre-ticked consent box.
Consent isn't needed for strictly functional cookies, such as load-balancing cookies and shopping trolley cookies. However, a cookie isn't 'strictly functional' if it is also used for non-functional purposes. Privacy-friendly cookies, such as Google Analytics are acceptable as long as they are set up in accordance with the guidance of the Data Protection Authority (DPA).
Big differences between members states
Across the EU, cookie regulations differ from one member state to the next. In the Netherlands, for example, Google Analytics cookies are permitted without consent (subject to certain conditions). In Belgium, however, such use is liable to attract a large fine. One of the taskforce's goals is to create greater consistency by providing explanations and performing analyses. The taskforce also aims to promote mutual support and communication amongst data protection authorities. Whether the taskforce will tackle any specific topics is not yet clear. What is apparent is that certain requirements made in other countries may well be extended to the Netherlands. For example, in Greece, 'Accept all' and 'Reject all' buttons have to be the same size and colour. It could easily be that the rule is extended to the Netherlands before long.
Better safe than sorry
To be sure of staying within the rules, the best approach is to include clear information in your cookie banner and to show visitors equally prominent 'Accept all' and 'Reject all' buttons. While that may not be ideal from a commercial perspective, one needs to bear in mind that your cookie banner is part of your site's shopfront. All being well, it's the first thing that visitors see. Your cookie banner is therefore an opportunity to make a positive impression on an increasingly privacy-aware internet-using public.
