Italy: New rules of the Garante for the use of cookies

10 June 2014

The awaited guidelines of the Italian Data Protection Authority related to the "Simplified Arrangements to Provide Information and Obtain Consent Regarding Cookies" (provision no. 229 of May 8, 2014) has been finally published on June 3, 2014 on the Italian Official Gazette.

The Guidelines, which is very innovative for certain aspects, provides specific guidance in relation to the simplified manners aimed at fulfilling the obligations to provide the information notice and to collect the consent of the web users to cookies. The Guidelines also clearly outlines the liabilities of both the "publishers" and the "third parties" of a website with reference to these obligations.

In particular, the Italian Data Protection Authority set out a clear distinction between the following two kinds of cookies:

  1. Technical cookies (including browsing cookies, analytics cookie and functional cookies) do not require any consent to be used, saved in any case the obligation of the publisher to notice the web users about the installation of these cookies, and
  2. Profiling cookies (i.e. cookies that are aimed at creating user profiles and are used to send ads messages in line with the preferences shown by the user during his/her navigation on the web) require the consent of the user before being installed together with a clear and immediate information notice about their use. Please consider that the use of profiling cookies must be registered (notificazione) with the Italian Data Protection Authority according to the Article 37, paragraph 1,lett. d) of the Italian Legislative Decree no. 196/2003.

In order to fulfil the notice and consent requirements related to the profiling cookies, the "publishers" makes available to the users - upon their access to the website - a banner including a brief information notice concerning the use of the profiling cookies. Such banner will allow the users, by means of a link, to access also to more detailed information about the use of cookies, including information concerning third parties' cookies, if any. The language used in the banner should make clear that by continuing the navigation on the website, either accessing to any website area or just selecting an element, the user specifically provides his/her consent to the installation and use of profiling cookies.

The publishers of the websites may use specific technical cookies to track and to keep evidence of the choices performed by the user (i.e. either if the user generally consented to cookies or if it selected specific cookies).

The deadline for both the publishers and the third parties to comply with the measures outlined in the Guidelines is June 3, 2015; a timely compliance will avoid the publishers and the third parties to incur in possible sanctions, the amount of which may be relevant.

We remain at your disposal:

  • To assist you in drafting or in the revision of the documentation to comply with the Guidelines above;
  • To assess the compliance of your internal procedures used to collect the users' consents; and
  • To assist you to set up appropriate measures to comply with local cookie rules existing in other jurisdictions, if applicable to the website you manage either in Italy or in other countries.