What are legal requirements for privacy policy for a website hosted in the US, used in Europe and with technical cookies only?

Question

My website is hosted in the U.S. but I am using it for my professional services in Europe.

The website uses only technical cookies and anonymized analytics (Google Analytics).

What should I specify in my privacy policy, except that these technical cookies and anonymized analytics are used?

Answer 1

I'll attempt to point you in the right directions here, while of course please be aware that it's merely a very very general answer. Even though European legislation is currently "harmonised" via a Directive that mandates implementation into national laws, it still has its implementation peculiarities.
Also, as usual, here goes the warning that this answer is for informational purposes and not for specific legal advice. So if you really need to further investigate, it is advisable to seek the assistance of a lawyer specialised in this particular practice of law. To some extent iubenda might be helpful, which is the company I work for and which is the main reason for some of my background/experience in the area.

Let's start with the simplest and most likely option: the UK.

The UK, being part of the EU takes a lot of their privacy related rules from European directives. The so called EU Data Protection Directive 95/46/EC has been implemented in March 2000 with the Data Protection Act 1998. Enforcement falls to the ICO, the Information Commissioner’s Office.

In general, they advise to inform about these things at least:

1. make sure people know who you are,
2. what you intend to do with their information,
3. who it will be shared with or disclosed to

Depending on the circumstances you may decide to go beyond the basic requirements of the law, for example by telling people:

• If you intend to pass information on, the name of the organisations involved and - details of how they will use the information
• how long you or other organisations intend to keep the information
• whether replies to questions are mandatory or voluntary
• the consequences of not providing information - for example, non-receipt of a benefit;
• whether the information will be transferred overseas;
• what are you doing to ensure the security of personal information;
• about their rights and how they can exercise them - for example, the fact that a person can obtain a copy of their personal information or object to direct marketing;
• who to contact if they want to complain or know more about how their information will be used;
• and about the right to complain to the Information Commissioner if there is a problem

The above is based on a manual released by the ICO. You must also be aware however, that within a year new rules will be introduced based on a real pan-European regulation called the GDPR.

Now that we have the main structure together, we can see about the cookies.

Technical cookies

Technical cookies famously don't require the users' consent ahead of time. However it's definitely good practice to still point that out within your privacy policy or cookie policy (likely also required). However since you're making use of cookies outside of the absolutely necessary - Google Analytics - you're required to inform about cookies anyway.

When setting cookies you're required to - tell people that the cookies are there, - explain what the cookies are doing, and - obtain their consent to store a cookie on their device.

The ICO provides an example section for wording:

Our website uses four cookies. A cookie is a small file of letters and numbers
that we put on your computer if you agree. These cookies allow us to 
distinguish you from other users of the website which helps us to provide you 
with a good experience when you browse our website and also allows us to 
improve our site.

The cookies we use are ‘analytical’ cookies. They allow us to recognise and 
count the number of visitors and to see how visitors move around the site when
they’re using it. This helps us to improve the way our website works, for
example by making sure users are finding what they need easily. Read more
about the individual analytical cookies we use and how to recognise them [link]

I'm linking you to the ICO's cookie guidance document if you want those deeper insights.

Google Analytics: Cookie blocking for more intrusive types

The implementation of the cookie law still vary heavily, the ICO's stance can be counted among the very permissive ones. There are more strict systems like the one by the French CNIL, Spain, Italy and more.

Based on those you must block these cookies (Google Analytics) before the user has given you their consent. In Germany and other countries the IP anonymisation is table stakes. It must be done by default.

France, for instance, allows Piwik to be there without the need of initial consent, while Google Analytics needs consent. Others might be more permissive.

If you run that business across many countries, it might make sense to just take the strictest approach: block these cookies before user consent (we've built something to help with cookie management at iubenda).

Another topic entirely might be the newly developed Privacy Shield, which I personally wouldn't be able to get into more deeply.

Hope this all helps.