Definition of Cookies
Cookies are small text files of different types that a website provider stores on the user’s computer. Cookies allow information to be used to facilitate navigation or to analyze the user’s behavior for the benefit of the website operator behind the screen.
CJEU: The Planet49 Judgment
In its judgment, the CJEU ruled that:
- a pre-checked checkbox does not constitute valid consent as such consent requires the user’s active, and not passive, behavior;
- this applies irrespective of whether the information stored and accessed via cookies is “personal data” as defined by the relevant EU legislation; and
- the website provider must inform the user of the duration of the operation of cookies and whether third parties may have access to those cookies.
The judgment makes clear that:
- ‘non-essential cookies’ may not be installed when users start their browsing of a website;
- website operators must provide cookie management options alongside clear and comprehensive information; and
- users must be able to easily withdraw their consent.
As mentioned above, despite the recent judgment(s), many website providers have not as of yet implemented a privacy-compliant consent mechanism and the rationale behind this practice is that the situation is not as clear as it may initially appear.
Website Cookies: A blurred legal situation
Defining a cookie strategy
In defining and setting up a cookies strategy, we advise website operators to consider (at least) the following:
- Whether to request consent for both analytical and tracking cookies;
- Whether the collected data can be accessed by third parties, and if this is clearly and properly disclosed to website users.
- Whether the data they collect rises to the level of ‘personal information’, and if so, whether it is covered by privacy policies and current company practices
- Whether existing cookie walls should be removed;
- Whether to amend cookie banners and include both the ‘Accept’ and ‘Decline’ buttons;
- Whether to provide information about cookie purposes and retention periods in the cookie banner; and
- What additional information should be included in the second-layer cookie statement.
Our firm helps our clients to navigate this increasingly complex and highly regulated landscape by providing clear and practical legal advice on data protection and privacy law issues. If you require any further information, please do not hesitate to contact us.