Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or clearing their cookies will reset this timer.
10 years is a completely arbitrary number that I came up with, but I was wondering if the GDPR has any specific guidelines on how often the website should ask for cookies.
Neither the GDPR or the EPrivacy Directive specify any duration. However, on 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that users must be informed of the duration before they consent to store cookies:
Although the duration of the processing of the data is not included as part of that information, it is, however, clear from the words ‘at least’ in Article 10 of Directive 95/46 that that information is not listed exhaustively. Information on the duration of the operation of cookies must be regarded as meeting the requirement of fair data processing provided for in that article in that, in a situation such as that at issue in the main proceedings, a long, or even unlimited, duration means collecting a large amount of information on users’ surfing behaviour and how often they may visit the websites of the organiser of the promotional lottery’s advertising partners.
That interpretation is borne out by Article 13(2)(a) of Regulation 2016/679, which provides that the controller must, in order to ensure fair and transparent processing, provide the data subject with information relating, inter alia, to the period for which the personal data will be stored, or if that is not possible, to the criteria used to determine that period.
So you can store the cookie forever, if you inform the user about the duration before they consent to storing cookies. As consent must be 'freely given', they can refuse if they don't accept that.
If you are storing data on the user then you need a lawful basis. The GDPR provides several, of which "consent" is only one.
You don't actually need a GDPR basis to store cookies on the user's computer. However if those cookies identify the user or store personal data then you do need a GDPR basis to do any processing on those cookies at your end. The typical situation is that you put a cookie containing a user ID on the user's computer, and back on your server there is a database which is keyed by that user ID. That way whenever the user comes back to your site you can match them to the database records. I'll assume this is the architecture you are using.
(The alternative scenario is that the cookies contain only user settings which are not tied to any data at your end, in which case you don't need to worry about the GDPR).
You need to consider each piece of processing you want to do with the user data and establish a lawful basis for it. This needs to be written up. Once you have established the lawful basis you will be able to determine how long you can keep the user data. Data minimisation is an important principle in GDPR.
Consent is actually the weakest of the lawful bases for processing, so you should try to establish one of the others first. If you do need consent for some of the processing then its important not to try to nudge the user into giving consent: pre-checked tick boxes and hidden opt-out forms don't count as consent.
Cookies are tools that process Personal Data and under GDPR Processing requires a Lawful Base.
Accepting the Cookies Policy will still mean that the user may opt-out from some Cookies being used to process his/ her Personal Data... so "accept Cookies Policy and that's it" is not a valid approach.
Personal Data Processing derives from "Purpose" and "Scope" under a Lawful Base and Services are finite, so you MUST erase the information gathered by Cookies once the Service ceases if there is no Legal Obligation to maintain it (ususally there is not, in opposition to let's say invoices that must be kept for 7 years but do not derive from Cookies Processing).
10 years for Cookies really seems way too much... it is not arbitrary, it MUST derive from the "need to process", having the DAta Subject aware of it and always enabling him/ her to opt-out.
Your Cookies Policy needs to detail WHAT each Cookie does and their relevancy towards the Services being rendered.
Some Cookies may act as Service enablers, therefore you need to explain that if the user opts-out from those, he/ she may not get the service that was contracted or expected.
Other Cookies are relevant for you as a company (e.g. Google Analytics), so the user (Data Subject) may really opt-out at any time, for there is no impact in the Service towards him/ her.
Then you may have Cookies that profile the user... well, regarding those you better comeup with a good explanation on why the user will hugely benefit from them... people is getting scared by the day, and opting out from anything that "smells" like "profiling".
If you are a developer, you should really get support from someone who knows about GDPR and not try to do your best, for ... well... do not take this wrong but odds are you will not do an assertive job.
Retention Period under GDPR... (39) ensuring that the period for which the personal data are stored is limited to a strict minimum. + (45) disclose (...) the storage period + (61) + (65) Data Subject has the ‘right to be forgotten’ where the retention of such data infringes this Regulation + Article 5 (e) + Article 6 (3) (b) + several more...
You could vary the amount of time you store the consent, but why would you? You can just keep a record that the user accepted the use of the cookie then let them opt out when they choose.
