5

I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect?

Say Bob is not only pissed off by the ostensible (as he thinks) necessity to implement the cookie accept buttons, but, instead of doing that, he is ballsy enough to write this sort of fine print on his website:

We will set whatever cookies we want and we won't ever ask your permission. We don't care what you think the law about it is. Take it or leave it (or sue us).

How soon would events occur which will make Bob change his mind and give in? What sort of events?

I would expect that the likely repercussions would pretty much depend on two factors:

  1. Jurisdiction (perhaps the most severe ones would occur in the EU)
  2. Popularity of the website (perhaps blog / small forum owners don't need to worry as much as big social network owners)

As I think case law on the subject would still be rather scarce, I leave this question jurisdiction-open (please tag your answer accordingly).

14
  • 1
    Does Bob intend to put up any kind of a defense if he's sued? – Nate Eldredge Apr 5 at 3:25
  • 1
    @NateEldredge Your question implies that there could be some successful line of defense (otherwise, why would it matter?). I would be very interested to know what that line of defense would be. In any event, Bob will attempt to challenge the (widely assumed necessary) link between cookies and breaching privacy. – Greendrake Apr 5 at 3:30
  • 1
    I didn't intend any such implication and I have no guesses as to what a viable defense might be, or whether they exist. But if Bob doesn't even intend to try, then an answer doesn't need to address them. – Nate Eldredge Apr 5 at 3:33
  • 1
    There is no cookie law. The cookie popups are completely idiotic and unnecessary. GDPR is concerned with private data, not how you store it (well, it's concerned with how securely you store it). – Davor Apr 5 at 15:45
  • 2
    @Davor Cookies are not, in general, covered by the GDPR. They are covered by the ePrivacy directive, and all EU member states have implemented it in their national laws. Bob could face penalties under those laws, as teh answer by amon indicates. Cookies that contain or are linked to identifiable personal information may also be covered by the GDPR. – David Siegel Apr 5 at 17:27
8

(, , )

The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet this definition of consent, so any non-necessary cookies set in that context would be a violation.

But it would be the national ePrivacy implementation that would be violated, not the GDPR. Thus, the GDPR's famous 4%/EUR 20M fines are not relevant here. Instead, each country can set its own fines. In Germany, this would probably be up to EUR 50k (§16 TMG) though German law doesn't implement this aspect of ePrivacy correctly. In the UK, PECR penalties are determined by more general data protection penalty legislation.

Notable instances of cookie consent enforcement include the Planet 49 (ECJ judgement, German BGH verdict) case which basically affirmed that yes, the GDPR's definition of consent applies. Thus, any case law regarding GDPR consent is also applicable to the issue of cookies. Furthermore, the Spanish AEPD has issued an interesting fine due to insufficient cookie consent, but due to much more subtle violations than the outright disregard in the given example. E.g. in the Vueling action (decision (Spanish, PDF), summary, listing on enforcementtracker), the Vueling airline's website had a consent banner but ultimately told the user to reject cookies via their browser settings. This violates the requirement that consent must be specific/granular, since the browser settings are all-or-nothing if they're available at all. The airline was fined EUR 30k, the maximum possible under applicable Spanish data protection law.

But what kind of risks would some blog run into that just sets cookies without appropriate consent?

  • If the service is outside of the EU, enforcement is difficult. I am not aware of cookie consent enforcement against non-EU services.
  • National data protection authorities can investigate the violation and issue fines, subject to their respective national data protection laws. They generally only do this when there are lots of complaints. Some authorities like the UK ICO have indicated that cookie consent enforcement isn't a priority for them.
  • Independently, individuals can generally sue the service for damages. Some lawyers might send out cease and desist letters to non-compliant websites in the hopes of collecting fees.

So aside from the last point, the risk is likely somewhat low, especially for a smaller site.

At this point, it is worth reminding that ePrivacy/GDPR doesn't require consent for all cookies, and is not just limited to cookies. It is more generally about access to and storage of information on a user's device, unless that access is strictly necessary to provide the service explicitly requested by the user. Thus, functional cookies can be set without consent. However, consent does become necessary when cookies or similar mechanisms are used for analytics, tracking, or ads. Even though GDPR is involved, the cookie consent requirements apply regardless of whether the cookies involve any personal data.

5
  • 1
    Addition regarding Planet49: the reasoning is in a good part "you are not allowed to pre-hook certain things" - also linked the Vueling airline listing on the GDPR tracker (was one of the 6 I listed on the other comment stream) as well as the BGH verdict. – Trish Apr 5 at 10:01
  • I thought that cookie consent issues can be interpreted as GDPR violations and not just ePrivacy violations, thus triggering GDPR fines. – o.m. Apr 5 at 15:46
  • 1
    @o.m. I can't find any good source in favour of that argument. GDPR itself is very general and does not discuss specific technical measures such as cookies or network communication. The ePrivacy Directive inherits various provisions from the 1995 Data Protection Directive which was replaced by the GDPR. This includes the definition of consent, which was therefore updated by GDPR. This also included sanctions from Chapter III DPD, but that just said “member states shall […] lay down the sanctions”. While the GDPR defines its own sanctions, this doesn't affect implementing ePrivacy legislation. – amon Apr 5 at 16:31
  • Not all cookies are personal data (in which case the GDPR does not apply) but if they are, then breaking the "cookie law" by processing them would be in breach of the principle that personal data must be processed lawfully. I.e. any unlawful processing of personal data becomes a GDPR violation. – Francis Davey Apr 5 at 21:49
  • @amon, I've changed my own answer in that regard. – o.m. Apr 6 at 4:09
5


Bob could be fined (not sued) by supervising authorities (not users).

Those fines can be hefty if the cookies contained PII (€20M or 4% of global revenue, whichever is higher), less so if they don't. The likelihood of being fined, and the amount, depend on coming to the attention of the authorities and the severity of the breach. So far most national supervising authorities have been far less extreme.

He can then "countersue" against that fine, which would be Bob going to court, not any user.

6
  • Has any Bob (of blog/forum owner size) been fined already? – Greendrake Apr 5 at 7:18
  • 1
  • 1
    @Greendrake there a GDPR violation fine tracker - which has 6 actions from Spain about insufficient fulfilment of information obligation on cookies. – Trish Apr 5 at 8:27
  • @Trish I've looked through some of the decisions listed on Enforcement Tracker, but they don't seem to relate to cookies at all. This is unsurprising, since cookie consent does not stem from GDPR. In my answer, I have discussed a Spanish fine for cookie consent violations against Vueling airlines. – amon Apr 5 at 9:49
  • @amon Check out these 6: ETid-364 ETid-369 ETid-298 ETid-220 ETid-86 ETid-121 – Trish Apr 5 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.