8

Given a Web Site which uses cookies for the following:

  • User Preferences
  • Bookmarked Articles
  • Cookie Preferences

what explicit permissions would be required from the user?

Here I anticipate the cookies would be set from JavaScript, so no identification of the user would be required. I know that cookies are sent to the server.

Improve this question

1 Answer 1

Reset to default
15

Not all cookies require consent.

The current answers are in WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194.

This WP29 Opinion is based upon Directive 2002/58/EC ("ePrivacy Directive"), and not GDPR, which is current law for this matter until other guidelines are adopted pursuant to GDPR or until the awaited "ePrivacy Regulation" is finally adopted.

1. General rules

This Opinion states 2 critera for cookie consent exemption:

(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:

CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”.

CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”.

2. User preferences

The first two types of cookies would be, as I understand, for the purpose of remembering user preference in how it interacts with the Website. Such types of cookies can fall under criterion B, under certain conditions.

Section 3.6 "UI customization cookies" explains the conditions that such type of cookies have to meet so that the consent exemption can apply, in particular:

User interface customization cookies are used to store a user’s preference regarding a service across web pages and not linked to other persistent identifiers such as a username. They are only set if the user has explicitly requested the service to remember a certain piece of information, for example, by clicking on a button or ticking a box. They may be session cookies or have a lifespan counted in weeks or months, depending on their purpose.

(...)

These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted (...). The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case

If you need to request consent, then WP 29 Working Document 02/2013 providing guidance on obtaining consent for cookies - 1676/13/EN WP 208 contains guidance.

3. Cookie Preference cookie

The last type of cookie you mention, being the Cookie Preference cookie, would be, as I understand, only used as a purely technical mean to store and retrieve (transmit) the user's explicit choices preferences, and would most probably fall clearly under criterion A and/or B.

Improve this answer
9
  • 1
    @PerDigre, I disagree. The search words are linked to the user of the browser.
    – Tardis
    Commented Jun 3, 2018 at 15:27
  • 1
    @Manngo, I fixed the link, sorry for that These documents do pre-date the GDPR, and were adopted at the time the 95 Directive was in force, but the work done by G29 and their recommendations is not incompatible with the GDPR's provisions, and should apply today, until (and if) other guidelines are adopted.
    – Tardis
    Commented Jun 3, 2018 at 18:36
  • 1
    @Manngo, GDPR is only about personal data. The cookies are linked to the browser, they do not necessarily know who the browser belongs to. You cannot ask for consent if you have no person to register the consent to. It is the same reason Google can present advertising based on searchwords from the session without asking consent. Also Hotels.com can present advertising based on previous searches (using domain cookies) without asking consent.
    – Per Digre
    Commented Jun 4, 2018 at 17:53
  • 1
    @PerDigre, again, I disagree. The cookies allow the server to single-out a user, and yes, you can perfectly program your site to request consent before a cookie is set when such consent is needed. Whether you know the identity of the user of the browser or not is irrelevant: you are still processing data concerning the user's navigation in a way that allows to single-out that user, and that is a personal data processing. Depending on the purpose of the collection and the type of cookie, consent will be required or not, and that is when WP29 Opinion on Cookie Consent Exemption is useful.
    – Tardis
    Commented Jun 6, 2018 at 8:38
  • 1
    @PerDigre, sure we can ;-) Indeed, matter is complex since e-Privacy Directive is lex specialis of the defunct 95 Directive on data protection. But the e-Privacy Directive and the coming e-Privacy Regulation are meant to protect privacy, and not only personal data. See: privacytrust.com/guidance/gdpr-vs-eprivacy-regulation.html Personally, until e-Privacy Regulation is adopted and other guidelines for cookies are issued, I would follow the mentioned WP29's Opinion. After all, it is the opinion of the data protection authorities of the EU about the e-Privacy Directive :-)
    – Tardis
    Commented Jun 7, 2018 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .