11

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts to implicit consent to the use of cookies.

Some online resources suggest that since GDPR states that consent must be explicit and revocable, that this also applies to cookies, rendering the "cookie banner" insufficient.

Many sites use 3rd party libraries which will store cookies for tracking, such as Google Analytics. Additionally, other 3rd party libraries, such as AddThis, store tracking cookies which cannot be disabled. To prevent the storage of these cookies, AddThis and some other functionality would need to not be included on the site at all if the user hadn't opted in, which could affect functionality. It may also require a fairly significant investment of time.

However, I don't see anything in the actually GDPR that relates to cookies in this sense. The application of GDPR to cookies seems to be based on independent interpretation.

Does GDPR actually require a change to cookie banner functionality, or are current implementations sufficient?

Improve this question
1
  • 1
    You don't find anything specific because this is a case like the others. Those cookies share personal information to third parties that the user may not even know about, so they need to be mentioned in your terms of use or privacy policy and the user needs to be able to give or revoke consent. There is no need whatsoever to load AddThis resources and inflict their cookies on your users, for instance: you can just host the resources locally and the users will go to AddThis if they click it.
    – Nemo
    Commented May 2, 2018 at 18:17

4 Answers 4

Reset to default
13

The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.)

As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid:

This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data.

However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site.

So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.

Improve this answer
1
  • 1
    While the rules haven't changed, the GDPR fines are a lot higher.
    – MSalters
    Commented May 14, 2018 at 8:42
2

A simple cookie banner is not sufficient.

Users have to opt in by clicking a button or checking checkboxes, note if using checkboxes they can not be pre-checked unless for "strictly necessary" cookies as defined by EPR.

As per the legislation valid consent can not be obtained by the user continuing to use the website or scrolling down the page. They have to expressly opt in as described above.

Nearly all Google and Facebook API services require you to set tracking cookies and marketing cookies on the users devices i.e. you can not use Google/Facebook Login, Google reCapatcha,Google Adsense, Google Analyitics without getting prior consent from the user to set tracking cookies and marketing cookies on the users devices.

It is the trade off of using the free APIs that Google and Facebook offer, they offer the SDKs and APIs for free but require personal information from the user in return.

Google's own terms require you to obtain consent from the user before using their APIs and thus setting tracking cookies and marketing cookies on the users device. So even if all the EU legislation did not exist you would still have to gain users consent before using the google SDKs/APIs.

Improve this answer
1

Cookie use is governed by directive 2002/58/EC (the ePrivacy directive) and not mainly by the GDPR. The ePrivacy directive defines consent through a reference to directive 95/46/EC, which the GDPR repealed and replaced. Article 94 of the GDPR further provides that

References to the repealed Directive shall be construed as references to this Regulation. […]

In other words, the rules on what count as valid consent under the GDPR also apply to the ePrivacy directive. So the GDPR did change things, albeit in an indirect way, even without explicitely dealing with cookies per se.

Since you asked your question, the matter has been further clarified by the courts (case C-673/17 of the EUCJ) and data protection authorities (Article 29 Working Party guidelines on consent). Arguably, opt-outs, implicit consent, and cookie walls were already questionable before all this but they are definitely not acceptable now (and you begin to see sites offer reasonable ways to consent to the use of cookies).

Note that some cookies use (including general analytics cookies) is acceptable without prior explicit consent. However if consent is required a banner warning about implicit consent or opt-out system is not enough to constitute freely given consent.

Improve this answer
0

I'm posting this as a guest user. The cookie liebanner is still on my mobile screen. I have refused to either accept OR deny anything on that liebanner.

I am able to post, regardless. I will not be creating an account and I will not be logging in.

To my mind that makes this site's claim of there existing a thing called a "strictly necessary" cookie a knowing and boldfaced lie. If I can post and edit posts without accepting those "strictly necessary" cookies, then those simply DO NOT EXIST as a thing, making this very site non-compliant.

Go ahead and try it yourself- I'll certainly be asking regulators to do so in my complaint to them.

And no- for the record, I do NOT consent to acceptance merely by continuing to post. I don't have to do that, and do not consider myself bound by any policy stating otherwise. As far as I'm concerned, any such policy in a site's EULA is unenforceable and therefore invalid.

And this site in particular should damned well know better than to so blatantly lie about this. That really, REALLY pisses me off, enough so to file a formal complaint with EU regulators.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .