2

Let's make a common example:

www.example.com is the main website of a company, then they have

blog.example.com that is the company's blog.

It's important to note that the same organization is behind both websites and is the unique owner of the first+second level domain name example.com.

The "blog" website could have been incorporated into the main website:

www.example.com/blog/

But this time this is not the case. There are many (valid) reasons to split a site via third-level domain names, as in the example above where the blog site is separated from the main site.

Now the question is: can the two website share the same cookie-consent-banner and the same cookie policy extended disclosure?

And more important (in order to avoid annoying the user): is it licit that when the user give consent on one web site it implicitly give consent to the other site?

Taking the initial example the user go to www.example.com. The banner is displayed and the user give consent accepting the cookie policy.

Then the user see the link "Visit our blog", navigates to the website's blog landing to blog.example.com.

Is it possibile to avoid displaying a banner again?

Provided of course that both the banner and the extended cookie policy are written in the correct way.

Improve this question
2

1 Answer 1

Reset to default
2

An issue highlighted with your question is whether the regulations target technical implementation of a web presence or target the user view of an organization's web presence.

From a technical perspective, a web address is nothing more than an addressing scheme. www.example.com, www2.example.com and example.com could all serve the same content from the same web server. It is not unusual for companies that have been acquired to point their old address, www.oldcompany.com to the acquiring company's, www.newcompany.com. The user, from whom consent is required, will experience one company's presence.

The regulations are designed to force the explicit consent from a user before certain types of information are stored and accessed on the user's equipment.

From the Information Commissioner's Office (ico), an independent UK authority you will find Guidance on the rules on use of cookies and similar technologies. On page 25 you can find,

Consent for cookies on more than one site

An organisation with several connected websites could in theory obtain consent for cookies set on each site in one place, for example when the user logged in on one site. In order for this consent to be valid it would have to be absolutely clear which websites the cookies in question were set on, what those cookies were used for and exactly what the user was agreeing to.

As long as the language provided to the user is clear and unambiguous when seeking consent then consent can be granted for multiple "sites," however that word is defined.

Depending on the purpose of the cookies, it may be that the types of cookies that would require consent may only be created for a sub-set of visitors. In such a case it may be desirable to only seek consent from those users who actually need to visit those particular areas of a web site. In this case, the "site" for which consent is required would be a subset of the overall organization's presence on the web.

It is up to the implementor of the site to determine when, where and with what language to get clear consent from the user before storing and accessing the type of data that requires consent. Note from the linked guidance that not all data storage and access requires explicit consent.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .