5

I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the GDPR but also other relevant data protection laws. My site uses session cookies for site functionality in addition to Google Analytics.

In my research, I've seen sites that state that consent for cookies doesn't need to be explicit (i.e. an Accept or Reject button) but can appear once with language that makes clear that continued use of the site (primarily scrolling and/or clicking links) implies consent. I've also seen sites stating the opposite. Time does seem to play a big factor in this - most information on GDPR compliance, including most of the relevant answers on this site, seem to date from 2018 when the regulation was first introduced, and since then it seems likely to have been fleshed out more, both outside of and inside of the courts.

So I'm here asking for a more up-to-date answer as of 2022 - does my website need to explicitly ask for cookie consent as of 2022?

Improve this question
1
  • The rules on cookie consent have not changed since 2018. There were few interesting court cases on that matter. The Planet49 case reaffirmed that GDPR definition of consent applies to cookies even if they don't involve personal data. There has been much change with regards to the use of analytics tools though in the wake of the Schrems II judgement on international data transfers. Given recent rulings and DPA guidance, it must be assumed that Google Analytics cannot be used in a GDPR-compliant manner.
    – amon
    Mar 18, 2022 at 9:23

1 Answer 1

Reset to default
2

Yes, It Does

The rules for cookies are not spelled out in the GDPR, but rather in the e-Privacy Directive (EPD), and in that Directive's implementation in national laws, those of EU members and of the UK. In the UK this is the Privacy and Electronic Communications Regulations as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. The EPD does borrow the definition of "consent" from the GDPR. It applies to non-EU sites that have visitors from within the EU.

The idea that a user may be treated as having given consent to cookies simply by using the site was never valid under the EPD, but until recently there was little enforcement of the EPD. Even now the various national authorities make GDPR enforcement a higher priority than cookie enforcement, it seems.

The directive makes several distinctions between types of cookies. The most important is between "Strictly necessary cookies" and all other cookies. Strictly necessary cookies do not require consent, although information about them must still be provided to the user.

See the page "Cookies, the GDPR, and the ePrivacy Directive". See also the official UK page What are the rules on cookies and similar technologies?

The directive dates from 2002. and was amended to strengthen the requirement for consent in 2009. It complements the GDPR, and in some matters takes precedence over the GDPR. It is still in effect as of 2022. A regulation to replace and strengthen it has been proposed, but not yet agreed upon.

According to the EU-based site linked above:

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

  • Receive users’ consent before you use any cookies except strictly necessary cookies.
  • Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
  • Document and store consent received from users.
  • Allow users to access your service even if they refuse to allow the use of certain cookies
  • Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

Note that under article 6 of the GDPR there are 6 possible lawful bases for processing personal data (PD), of which consent is only one, but under the EPD consent is required for any cookie that is not strictly necessary. Consent must be "freely given" as defined in GDPR Article 4, paragraph (11). This means that the operator may not deny use of the site to those who do not consent.

Users must be able to consent to some cookies but not others, and must be able to withdraw consent easily at any time.

The types of cookies defined on the EU-based site linked above are:

Duration

  • Session cookies – These cookies are temporary and expire once you close your browser (or once your session ends).
  • Persistent cookies — This category encompasses all cookies that remain on your hard drive until you erase them or your browser does, depending on the cookie’s expiration date. All persistent cookies have an expiration date written into their code, but their duration can vary. According to the ePrivacy Directive, they should not last longer than 12 months, but in practice, they could remain on your device much longer if you do not take action.

Provenance

  • First-party cookies — As the name implies, first-party cookies are put on your device directly by the website you are visiting.
  • Third-party cookies — These are the cookies that are placed on your device, not by the website you are visiting, but by a third party like an advertiser or an analytic system.

Purpose

  • Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
  • Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in.
  • Statistics cookies — Also known as “performance cookies,” these cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions. This includes cookies from third-party analytics services as long as the cookies are for the exclusive use of the owner of the website visited.
  • Marketing cookies — These cookies track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers. These are persistent cookies and almost always of third-party provenance.

Note that cookies are merely one example (albeit the most common example) of "local data". Local data is any data stored on the user's device by the provider, plus any data read from the user's device by the provider. Cookies are often both read and set by the site, and so are local data on both grounds.

All the rules listed above for cookies apply equally to all forms of local data.

Google Analytics

It has been asserted in the past that use of Google Analytics (GA) males a site non-compliant with the EPD, This would be true if GA automatically dropped cookies before the site had obtained affirmative consent for cookie use.

It has also been asserted that sharing PD with GA (which is US-based) violates the GDPR provisions on internatiuonal transfers of data since the Schrems II judgement held that the US did not have adequate legal privacy protections. Transferring any PD from the EU to GA is thus legally dubious at best.

According to the page "Google Analytics, GDPR, and ePrivacy" from Cookie Pro GA can be used in a compliant manner. That pageadvises:

Website owners that use Google Analytics and have visitors from the EU, must gain consent to drop the cookies required by this service

Should they not do this, site owners would not only be at risk of a fine from GDPR, but would also be at risk of losing access to Google Analytics. Steps website owners need to take include:

  1. Have a Cookie Policy that clearly explains which cookies are in use on your website and what the cookies do. The policy should be kept up-to-date and should be easy to understand, even by those without a technology background. ...
  2. Display a cookie banner when a user first lands on your site in order to gain consent for the use of cookies. The banner should provide a simple explanation about what the cookies are used for and provide a way for users to accept or reject the use of cookies. In order to have the greatest chance of staying compliant with GDPR and ePrivacy, websites should not drop cookies—other than those deemed strictly necessary—until after they have received permission to do so.
  3. Provide a way for users of your website to revoke their permission to store cookies. Revoking permission should be as easy to do as it was to give permission in the first place.
  4. Have a form that allows users to request the deletion of personal information.

In addition, website owners should take steps to control the information they are sending to Google.

For example:

  • Website owners have to ensure they are not accidentally sending any personally identifiable information to Google, including addresses, email address, etc. If this is happening, they will have to take steps to stop it.
  • GDPR considers IP addresses as online identifiers. Because of this, you should turn on IP anonymization. Website owners can do this using the Google Analytics Tag Manager
Improve this answer
6
  • gdpr.eu is NOT an official EU site! It is a content marketing site from Protonmail (who have received EU funding for an unrelated project). The people writing those articles are journalists, not privacy pros. Official EU sites are hosted on europa.eu subdomains.
    – amon
    Mar 18, 2022 at 9:29
  • Google Analytics can be fine from a cookie consent perspective (the site must ask for consent before allowing GA to set such cookies). But use of GA and similar US-based SaaS tools is coming increasingly under fire in the wake of the Schrems II judgement on international data transfers. Enforcement has ramped up considerably over the last 6 months or so. An EU-based data controller should now treat GA as off limits, but continued use might be fine in the UK.
    – amon
    Mar 18, 2022 at 9:35
  • @amon Thanks. I have removed the "official" designation from my mention of gfpr.eu. I have added a mention of the Schrems II judgement. Note thast the answer already included the statement "Website owners have to ensure they are not accidentally sending any personally identifiable information to Google". Is this change to the answer sufficient, do you think?
    – David Siegel
    Mar 18, 2022 at 14:53
  • I think the answer is generally correct wrt cookies, but is misleading wrt Google Analytics. The Cookie Pro page was written a month before Schrems II and completely ignores the issues of international transfers. IP addresses are personal data. Merely loading the GA script, without even collecting any data or setting cookies, necessarily already discloses the visitor's IP address to a Google server, constituting an international transfer. The analytics cookie consent problem can be solved in a compliant manner, yes, but that alone is not sufficient to do analytics in a GDPR-compliant manner.
    – amon
    Mar 18, 2022 at 16:41
  • @Amon That pages does specifically mention the issue of intentional transfer, but the details may well be out of date. I will consider how best to revise the answer.
    – David Siegel
    Mar 18, 2022 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .