Description of 3rd party cookies in the privacy policy for GDPR compliance?

Question

In order to comply with GDPR's right to be informed section, some sites try to describe what specific cookies that 3rd parties supply do. Is it OK to just list what cookies these parties set, and instruct the reader to "Google" for more information on their specific usage, as this is obviously something that will continuously change.

So for example for Google Analytics we might have something like this:

Please search (For example search for "Google Analytics website cookie usage") for information on what these cookies are used for, as their use cases, and the platform facilitating these, are continuously being updated.

Would also be nice if the regulators that designed the GDPR guidelines signed up for a forum like this, so that we could get answers from the source of the regulations.

Answer 1

I think it's important - even post GDPR - to keep things apart that are supposed to be treated separately. Cookies are still regulated by the "good old" ePrivacy Directive (which will eventually be replaced by the ePrivacy Regulation).

Now, under the ePrivacy regulation, cookie compliance was largely regional across Europe and various practices have emerged.

Regarding the requirement to name cookies one by one, the Italian authority (the Garante Privacy), for instance, took a very pragmatic approach:

It's considered enough to link to the third party's privacy/cookie policy to inform people. The authority considers it impossible for site owners to be on top of constantly changing surroundings. However, the authority considers it necessary to block cookies before consent by users (of course there are exceptions). What you've come up with therefore, has been thought through by at least one authority.

Though certainly the purposes don't usually change and that's what you need to outline in a privacy policy.

Answer 2

Regardless of what the useless Cookie Law says (and now the new GDPR law makes the Cookie Law even more useless), users do not care and should not care about those details. Nobody cares about what cookies are used, what they are named, and how they work exactly. The only thing that is important, and is now required by the GDPR, is the final purpose, that is, what data you are collecting and why.

A user might want to know how each cookie works exactly to be able to selectively block some unwanted behavior (like tracking cookies), while allowing other behavior by accepting the appropriate cookies. However this would require reading several information and tweaking the browser settings. The GDPR says that explicit consent must be given for collecting and processing any data that is not "necessary", and that the user must be able to give or revoke that consent easily without having to change their browser settings. So, as you can see, the GDPR makes it totally useless to require a description of the cookies.

If you want you could always include a note that says "please contact us if you want to know more information about the cookies and similar technologies that we use for collecting data".