Yes, It Does
The rules for cookies are not spelled out in the GDPR, but rather in the e-Privacy Directive (EPD), and in that Directive's implementation in national laws, those of EU members and of the UK. In the UK this is the Privacy and Electronic Communications Regulations as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. The EPD does borrow the definition of "consent" from the GDPR. It applies to non-EU sites that have visitors from within the EU.
The idea that a user may be treated as having given consent to cookies simply by using the site was never valid under the EPD, but until recently there was little enforcement of the EPD. Even now the various national authorities make GDPR enforcement a higher priority than cookie enforcement, it seems.
The directive makes several distinctions between types of cookies. The most important is between "Strictly necessary cookies" and all other cookies. Strictly necessary cookies do not require consent, although information about them must still be provided to the user.
See the page "Cookies, the GDPR, and the ePrivacy Directive". See also the official UK page What are the rules on cookies and similar technologies?
The directive dates from 2002. and was amended to strengthen the requirement for consent in 2009. It complements the GDPR, and in some matters takes precedence over the GDPR. It is still in effect as of 2022. A regulation to replace and strengthen it has been proposed, but not yet agreed upon.
According to the EU-based site linked above:
To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
- Receive users’ consent before you use any cookies except strictly necessary cookies.
- Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
- Document and store consent received from users.
- Allow users to access your service even if they refuse to allow the use of certain cookies
- Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.
Note that under article 6 of the GDPR there are 6 possible lawful bases for processing personal data (PD), of which consent is only one, but under the EPD consent is required for any cookie that is not strictly necessary. Consent must be "freely given" as defined in GDPR Article 4, paragraph (11). This means that the operator may not deny use of the site to those who do not consent.
Users must be able to consent to some cookies but not others, and must be able to withdraw consent easily at any time.
The types of cookies defined on the EU-based site linked above are:
Duration
- Session cookies – These cookies are temporary and expire once you close your browser (or once your session ends).
- Persistent cookies — This category encompasses all cookies that remain on your hard drive until you erase them or your browser does, depending on the cookie’s expiration date. All persistent cookies have an expiration date written into their code, but their duration can vary. According to the ePrivacy Directive, they should not last longer than 12 months, but in practice, they could remain on your device much longer if you do not take action.
Provenance
- First-party cookies — As the name implies, first-party cookies are put on your device directly by the website you are visiting.
- Third-party cookies — These are the cookies that are placed on your device, not by the website you are visiting, but by a third party like an advertiser or an analytic system.
Purpose
- Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
- Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in.
- Statistics cookies — Also known as “performance cookies,” these cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions. This includes cookies from third-party analytics services as long as the cookies are for the exclusive use of the owner of the website visited.
- Marketing cookies — These cookies track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers. These are persistent cookies and almost always of third-party provenance.
Note that cookies are merely one example (albeit the most common example) of "local data". Local data is any data stored on the user's device by the provider, plus any data read from the user's device by the provider. Cookies are often both read and set by the site, and so are local data on both grounds.
All the rules listed above for cookies apply equally to all forms of local data.
Google Analytics
It has been asserted in the past that use of Google Analytics (GA) males a site non-compliant with the EPD, This would be true if GA automatically dropped cookies before the site had obtained affirmative consent for cookie use.
It has also been asserted that sharing PD with GA (which is US-based) violates the GDPR provisions on internatiuonal transfers of data since the Schrems II judgement held that the US did not have adequate legal privacy protections. Transferring any PD from the EU to GA is thus legally dubious at best.
According to the page "Google Analytics, GDPR, and ePrivacy" from Cookie Pro GA can be used in a compliant manner. That pageadvises:
Website owners that use Google Analytics and have visitors from the EU, must gain consent to drop the cookies required by this service
Should they not do this, site owners would not only be at risk of a fine from GDPR, but would also be at risk of losing access to Google Analytics. Steps website owners need to take include:
- Have a Cookie Policy that clearly explains which cookies are in use on your website and what the cookies do. The policy should be kept up-to-date and should be easy to understand, even by those without a technology background. ...
- Display a cookie banner when a user first lands on your site in order to gain consent for the use of cookies. The banner should provide a simple explanation about what the cookies are used for and provide a way for users to accept or reject the use of cookies. In order to have the greatest chance of staying compliant with GDPR and ePrivacy, websites should not drop cookies—other than those deemed strictly necessary—until after they have received permission to do so.
- Provide a way for users of your website to revoke their permission to store cookies. Revoking permission should be as easy to do as it was to give permission in the first place.
- Have a form that allows users to request the deletion of personal information.
In addition, website owners should take steps to control the information they are sending to Google.
For example:
- Website owners have to ensure they are not accidentally sending any personally identifiable information to Google, including addresses, email address, etc. If this is happening, they will have to take steps to stop it.
- GDPR considers IP addresses as online identifiers. Because of this, you should turn on IP anonymization. Website owners can do this using the Google Analytics Tag Manager