2

Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe> element. (Youtube is used here as an example only. This question is about combining content from multiple different hosts in general.)

It seems that commonly believed solution is to require Cookie Consent on the host page. Why? The cookie is not set by the host document server. Its value cannot ever be seen by the server providing the host document for the <iframe> element even if the server administrator wanted to monitor their users.

To me, the obvious solution to the problem is that if the embedded document wants to save non-necessary cookies, it should provide the cookie consent before storing such cookies.

Are there any prior decisions in some jurisdiction that specify that host document should request the cookie consent instead? And if so, how the host document is supposed to transfer information about this consent to embedded content hosting server? It doesn't sound reasonable to me that if your document is embbedded in a <iframe> element, you don't ever need the consent to set non-necessary cookies.

3
  • "The cookie is not set by the host document server." - a lot of the cookies that are set for a page are not set by the host server, but are set by elements of the page the host server sends, for example Google Analytics cookies are set by Googles servers and not the pages. I see no reason why the requirements for these sort of cookies would be any different for any other type of embedded content such as an iframe.
    – user28517
    Sep 2, 2020 at 9:31
  • Google Analytics requires adding identifier in the page source + running Google provided JavaScript in your host document. Obviously, Google can then track the user at will. That's the reason consent is required in that case. Sep 2, 2020 at 15:04
  • @MikkoRantalainen When using GA in the default configuration you are the data controller and Google the data processor. Your tracking code (UA-1234-01) is not personal data, but the Client ID stored in a cookie is an online identifier in the sense of the GDPR. Since you are the controller, you are responsible for GA cookie consent. GA additionally makes it possible to share data with Google as another controller, but that has nothing to do with cookies or identifiers therein.
    – amon
    Sep 2, 2020 at 15:58

1 Answer 1

2

The data controller is responsible for GDPR compliance. For embedded content, case law such as the Fashion ID case indicates a joint controllership where both the controller of the embedding page and the controller of the embedded content are controllers. However, one can only be controller for processing activities where one has influence on the means and purposes of processing. So the controller of the embedding page is a controller with respect to the act of embedding (with purposes like showing a video), but they wouldn't be a controller for subsequent processing by that embedded content (with purposes like tracking people across the web).

For determining who is a controller, it is not too helpful to look at which servers sent which HTTP headers. Instead, look at which processing activities occur, for what purposes that processing is carried out, and who had input to determining these purposes. Those (natural or legal) persons are data controllers and are therefore responsible for compliance.

What does this mean for the example of embedding a Youtube video, Tweet, or Like button?

The controller of the embedding page needs a legal basis for sharing visitor's personal data with the embed provider. Such a sharing is inevitable due to the embedding, regardless of whether cookies are involved. Typically, the legal basis used here would be consent: in place of the embed, a placeholder is shown that lets visitors opt in to loading the content. In some cases, a legitimate interest argument might also work.

Whether the embedded content ends up using cookies is outside of the embedding page's control. Thus, I would think the controller of the embedded content would be the sole controller with respect to these cookies. Of course, no consent is required for the use of cookies when this use is strictly necessary to provide the service requested by the user, e.g. to add a video to a logged-in user's Youtube history.

The joint controllers can divide up compliance obligations among themselves. For example, the provider of the embed content could likely require embedders to collect necessary consents prior to embedding (Twitter has similar terms). However, this would be risky for the controller because controllers shall be able to demonstrate that valid consent was actually given.

So in conclusion, I largely agree with your analysis that the provider of the embedded content should consider cookie consent. With two caveats: the controllers might have an agreement that moves this responsibility to the embedder, and the embedding data controller might need consent to embed the content in the first place.

8
  • It's true that embedding leaks info about page visitor in form of Referer header. However, that's allowed without consent as defined by GDPR. GDPR only specifies that consent is required to store non-necessary information that can identify the person on the end user's computer (in practice, browser storage). Note that if the same embed code is used for all (or even multiple) visitors, the embedded content host cannot use the URL of the embedded content as the identifier for any given person. As such, my reasoning is that GDPR consent is not required. Sep 2, 2020 at 15:02
  • Your point about Data Controller always being some legal person is a really good point! Sep 2, 2020 at 15:03
  • @MikkoRantalainen This is not about the referer header or about non-necessary cookies. By embedding a third party resource, you cause visitor personal data (such as IP address) to be sent to that third party. This processing requires a legal basis, which may or may not be consent (GDPR has NO specific rules on what is allowed here, if you think legitimate interest works then go for it). Cookie consent requirements are in addition to that (but more of an ePrivacy thing than a GDPR thing).
    – amon
    Sep 2, 2020 at 15:56
  • IP address is necessary data for any data exchange over internet. There's no way any service can request consent before using IP address. If that's interpreted as personal data that requires consent before being used, all CDN systems must be prevented from working, too. In addition, if host server sends header referrer-policy: origin-when-cross-origin the embedded content provider cannot even receive information about the actual page used by the host domain visitor. Sep 2, 2020 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .