Global Cookie Review (4th edition)
This Global Cookie Review covers key legal frameworks across the globe and answers some of the key questions that are important to consider when looking to make use of these technologies. These considerations apply equally whether these frameworks are specific to cookies or more broadly applicable to personal data but mapping across to the use of cookies and the data collected through such technologies.
Cookies and similar technologies are very commonly used as part of targeted advertising through the use of AdTech. Globally, AdTech as a sector is under increasing scrutiny from regulators and, as such, the provision and use of AdTech comes with additional considerations, whether relating to cookies or more broadly. We are also seeing seismic shifts in the industry on the horizon, driven by commercial changes throughout the ecosystem. As a result, we have specifically included notes on the use of these technologies in an AdTech context and we anticipate significant additional considerations to be addressed in this Global Cookie Review in the future.
Navigate your way through key jurisdictions below. If you have any questions about the content, please get in touch with our Head of Adtech, Alex Dixie.
EMEA Summary
Although the specific rules relating to cookies and other similar devices have been well established in Europe for many years, we have seen an increase in focus over recent years on the use of cookies.
The increasing sophistication of behavioural profiling and increasing volumes of data being used for these purposes has resulted in these activities, and the underlying use of cookies and similar technologies, being a key target for privacy activists. With high-profile challenges from None of Your Business and campaigners such as Johnny Ryan, a number of DPAs, in particular in Germany, France, Italy, Poland and Spain, have increased enforcement activity across all uses of cookies, not just those used for advertising, and some (such as the ICO in the UK) have launched full investigations into the use of AdTech more generally.
Overview by Jurisdiction
Austria Belgium Czech Republic Denmark Finland France Germany Greece Hungary Ireland Italy Luxembourg Netherlands Poland Portugal South Africa Spain Sweden Switzerland UAE UK
APAC Summary
When compared to Europe, you will find a greater degree of divergence between the rules in APAC territories given the absence of a regionwide GDPR-equivalent. However, some territories are feeling the indirect effect of GDPR, and we are seeing a general trend towards European levels of regulation and cookie rules drafted with the GDPR as influence. China introduced its first data protection law (‘PIPL’) that came into force at the beginning of November 2021. Under the previous regime and in previous judgments, cookies and similar technologies were not deemed to be personal information. However, PIPL may usher in a new era of publicity and enforcement previously unseen for cookies and other AdTech-related practices. As such, it will be interesting to see how these new rules are adopted in practice across the market.
In Australia, Hong Kong, Singapore and South Korea, there are currently no cookie-specific regulations, however privacy laws in these jurisdictions may impact the use of cookies to the extent personal data is involved. However, in Australia there have been reform proposals to the Privacy Act. The Australian Government Response to the Privacy Act Review signals significant changes to the rules are on the horizon. The Australian Government has committed to introduce draft legislation in 2024 concerning those proposals The proposed reforms include a redrafting of what ‘personal information’ means, so that it will explicitly include online identifiers. This increased spotlight on the wider AdTech industry is reflected in the recent flurry of activity and enforcement taken by the regulators.
Overview by Jurisdiction
Latin America Summary
Traditionally, regulations on personal data protection in Latin American countries have been largely inspired by those in Europe. This is mainly due to language and cultural similarities many Latin American countries share with Spain, resulting in widespread application of Spanish regulations (and thus reflecting GDPR).
With the exclusion of Brazil, there are no express references to cookies in the regulations or guides published by the DPAs of Latin America. On 19th October 2022, Brazil’s DPA (the ‘ANPD’) issued specific guidance on cookies. It is yet to be seen as to whether this will have an influence outside Brazil; organisations are advised to keep a watchful eye. This guidance specifically identifies a lack of transparency as one of the potential problems to watch out for when using cookies. Whilst in recent years Latin American DPAs have demonstrated an increased awareness and activeness to monitor compliance, there is still significantly less enforcement activity in comparison with the European regulators.
Overview by Jurisdiction
United States Summary
This edition of the Global Cookie Review also incorporates our previous published supplement covering laws in the United States.
The United States currently does not have a standalone law governing the use of cookies on the federal level. However, in recent years, several states have adopted their own privacy frameworks, with at least nine of these (California, Virginia, Colorado, Connecticut, Florida, Montana, Oregon, Texas and Utah) in effect or expected to be in effect by the end of 2024. Policymakers in Iowa, Indiana, and Tennessee have likewise passed similar legislation that will enter into force in upcoming years.
Overview by Jurisdiction
FEATURED VIDEO
Global Cookie Review Launch (4th edition) - what’s on the horizon for global cookie enforcement activity?
Partner and Head of Adtech, Alex Dixie was joined by Partner Lennart Schüßler and Associate Cat Hughes to dissect global cookie regulation in light of the new edition of the Global Cookie Review, with a particular focus on enforcement activity and trends, what businesses need to look out for in the coming year and how to mitigate the impact of these new global legislative frameworks.
