10

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts to implicit consent to the use of cookies.

Some online resources suggest that since GDPR states that consent must be explicit and revocable, that this also applies to cookies, rendering the "cookie banner" insufficient.

Many sites use 3rd party libraries which will store cookies for tracking, such as Google Analytics. Additionally, other 3rd party libraries, such as AddThis, store tracking cookies which cannot be disabled. To prevent the storage of these cookies, AddThis and some other functionality would need to not be included on the site at all if the user hadn't opted in, which could affect functionality. It may also require a fairly significant investment of time.

However, I don't see anything in the actually GDPR that relates to cookies in this sense. The application of GDPR to cookies seems to be based on independent interpretation.

Does GDPR actually require a change to cookie banner functionality, or are current implementations sufficient?

  • 1
    You don't find anything specific because this is a case like the others. Those cookies share personal information to third parties that the user may not even know about, so they need to be mentioned in your terms of use or privacy policy and the user needs to be able to give or revoke consent. There is no need whatsoever to load AddThis resources and inflict their cookies on your users, for instance: you can just host the resources locally and the users will go to AddThis if they click it. – Nemo May 2 '18 at 18:17
10

The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.)

As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid:

This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data.

However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site.

So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.

  • While the rules haven't changed, the GDPR fines are a lot higher. – MSalters May 14 '18 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.