5

Given a Web Site which uses cookies for the following:

  • User Preferences
  • Bookmarked Articles
  • Cookie Preferences

what explicit permissions would be required from the user?

Here I anticipate the cookies would be set from JavaScript, so no identification of the user would be required. I know that cookies are sent to the server.

10

Not all cookies require consent.

The current answers are in WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194.

This WP29 Opinion is based upon Directive 2002/58/EC ("ePrivacy Directive"), and not GDPR, which is current law for this matter until other guidelines are adopted pursuant to GDPR or until the awaited "ePrivacy Regulation" is finally adopted.

1. General rules

This Opinion states 2 critera for cookie consent exemption:

(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:

CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”.

CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”.

2. User preferences

The first two types of cookies would be, as I understand, for the purpose of remembering user preference in how it interacts with the Website. Such types of cookies can fall under criterion B, under certain conditions.

Section 3.6 "UI customization cookies" explains the conditions that such type of cookies have to meet so that the consent exemption can apply, in particular:

User interface customization cookies are used to store a user’s preference regarding a service across web pages and not linked to other persistent identifiers such as a username. They are only set if the user has explicitly requested the service to remember a certain piece of information, for example, by clicking on a button or ticking a box. They may be session cookies or have a lifespan counted in weeks or months, depending on their purpose.

(...)

These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted (...). The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case

If you need to request consent, then WP 29 Working Document 02/2013 providing guidance on obtaining consent for cookies - 1676/13/EN WP 208 contains guidance.

3. Cookie Preference cookie

The last type of cookie you mention, being the Cookie Preference cookie, would be, as I understand, only used as a purely technical mean to store and retrieve (transmit) the user's explicit choices preferences, and would most probably fall clearly under criterion A and/or B.

  • Also, if the cookie does not contain information identifying a person it would not be subject to GDPR's privacy regulation. Example, if hotels.com leaves a cookie remembering search words then it would be ok to later present advertising based on those serach words. – Per Digre May 31 '18 at 18:43
  • This answer looks very promising. I am having trouble with the link on providing guidance on obtaining consent for cookies.. Is it this one: ec.europa.eu/justice/article-29/documentation/… ? Also, the documents predate the GDPR requirement — are they current? – Manngo May 31 '18 at 22:23
  • 1
    @Manngo, I fixed the link, sorry for that These documents do pre-date the GDPR, and were adopted at the time the 95 Directive was in force, but the work done by G29 and their recommendations is not incompatible with the GDPR's provisions, and should apply today, until (and if) other guidelines are adopted. – Tardis Jun 3 '18 at 18:36
  • 1
    @Manngo, GDPR is only about personal data. The cookies are linked to the browser, they do not necessarily know who the browser belongs to. You cannot ask for consent if you have no person to register the consent to. It is the same reason Google can present advertising based on searchwords from the session without asking consent. Also Hotels.com can present advertising based on previous searches (using domain cookies) without asking consent. – Per Digre Jun 4 '18 at 17:53
  • 1
    @PerDigre, sure we can ;-) Indeed, matter is complex since e-Privacy Directive is lex specialis of the defunct 95 Directive on data protection. But the e-Privacy Directive and the coming e-Privacy Regulation are meant to protect privacy, and not only personal data. See: privacytrust.com/guidance/gdpr-vs-eprivacy-regulation.html Personally, until e-Privacy Regulation is adopted and other guidelines for cookies are issued, I would follow the mentioned WP29's Opinion. After all, it is the opinion of the data protection authorities of the EU about the e-Privacy Directive :-) – Tardis Jun 7 '18 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.