The Article 29 Working Party has, on 2nd October 2013, adopted a new opinion on consent for cookies.
Some elements of the Opinion will be difficult for publishers, ad networks and others to implement. Cookies should only be set after the user has accepted cookies (on most sites, cookies are placed before the user has dismissed, or navigated beyond, a cookie banner). The Opinion also suggests that for consent to be valid, detailed information must be provided - such as details of and even the expiry date of, each cookie.
Helpfully, however, the Opinion accepts that banners or overlays, which alert the user to cookies and advise that, by continuing to use the site, the user will be giving consent to cookies, can be a valid mechanism for consent.
The Opinion sets out what those placing cookies must do to obtain consent which will be valid in every Member State across the EU. The Opinion, therefore, suggests a one size fits all approach by harmonizing at the highest standards for a website that operates across several or all EU Member States: not all elements of the Opinion may be needed in all States. The renewed attention being given to this topic by the Working Party, however, may well indicate that some data protection authorities are starting to look more seriously at compliance. It will be interesting to see if enforcement action follows.
For consent to be valid across the EU it must include 'each of the main elements, specific information, prior consent, indication of wishes expressed by user's active behaviour and an ability to choose freely'.
- Should be provided about each cookie, or types of cookies.
- Should include expiry date, typical values, information about third party cookies and other technical information.
- The information should not 'disappear' until the user has expressed his/her consent.
- Before cookies are placed.
- The consent mechanism should be on the entry page.
- Overlays which disappear are not sufficient.
- Other forms of overlays or dialogue boxes could be used.
- Clicking on a 'cookie' link shows that the user wants more information about cookies, it does not demonstrate consent.
- The Working Party states that publishers should not make access to an entire site dependent on acceptance of cookies. The Directive allows 'specific content' to be conditional on acceptance of cookies. The Working Party argues that this means that access to a whole site cannot be conditional on acceptance of cookies.
- The Working Party notes that some Member States do allow this. However, for public authorities, this practice is likely to mean that consent is not freely given.
- When tracking cookies are used to single people out, for example, to allow individual behaviour across websites to be tracked or to create profiles based on behaviour, then, according to the Working Party, there is "likely to be personal data". The Working Party considers that unambiguous consent of the user must be obtained for this.