1

Sweden have a "cookie law" that requires constent for non-necessary cookies. But the law seems way more general.

Information may be stored in or accessed from a subscriber's or user's terminal device on if the subscriber or user gets access to information about the purpose of the processing and consents to it. This does not prevent such storage or access that are required for the transmission of an electronic message through an electronic communication net or that is necessery to provide a service that the user or subscriber expressly has requested.

Riksdagen - Lagen om elektronisk kommunikation 6 kap 18§ (my translation).

Does the cookie law also apply to the use of JavaScript? For example, given this code:

var advertising = getAdvertising();
showAd(advertising);

Do I require consent before serving that code? Why or why not?

6
  • 1
    Uncaught ReferenceError: getAdvertising is not defined.
    – xngtng
    Jul 1, 2022 at 9:52
  • The only thing that matters is if you are causing information to be "stored in or accessed from a subscriber's or user's terminal device" and if such use is technically necessary for the provision of a service the user requested.
    – xngtng
    Jul 1, 2022 at 9:55
  • @xngtng That would mean that a lot of current JavaScript uses on the web are not legal, right? That seems unlikely, no? (Also, getAdvertising=()=>"hi"; showAd=alert ;)
    – Per R
    Jul 1, 2022 at 10:03
  • If what I think you are trying to ask is what you are trying to ask, JavaScript variables are irrelevant; regardless if you "store" something in a variable in a script, the script itself has been downloaded and exists on the user's device. Whether this is covered by a specific or general exemption or presumed consent would be a good question.
    – xngtng
    Jul 1, 2022 at 10:14
  • @xngtng Since the user asked to see the website, downloading the JavaScript file is probably "necessary", but showing ads is proably not. Does this clarify what I meant?
    – Per R
    Jul 1, 2022 at 11:17

1 Answer 1

1

Yes, the ePrivacy Directive is way more general than cookies. The translated Swedish law seems close to the original in the ePrivacy Directive:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent […]. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

(from Art 5(3) ePrivacy Directive)

So, the general question when you access some JavaScript API is: what is the purpose of this access?

  • Is the access necessary for performing a service that the user explicitly requested? Then fine. For example, reading the browser window size or device class for the purpose of providing an appropriate layout is fine, because the user explicitly requested you to show them the website. Using LocalStorage to store user data for an offline-capable webapp is perfectly fine.

  • Otherwise, you will need consent. For example, reading the browser window size or device class for the purpose of better ad targeting would require consent, because the user did not explicitly request that you show them targeted ads. The user requested to see a website, and showing ads is not strictly necessary for that. Similarly, using any technologies that access or storage on the user's device to access, store, infer, or construct an advertising ID would require consent.

The WP29 has discussed this aspect of the ePrivacy Directive in their Opinion 9/2014 on device fingerprinting (PDF). They explicitly note that “JavaScript objects (e.g., document, window, screen, navigator, date and language)” can be used to form a fingerprint, for example by accessing “information relating to the screen size, colour depth and available system fonts. Other APIs may request access to information elements stored in the firmware (e.g. the CPU type), operating system (e.g. the OS type) or graphics card model. API calls may also reveal the presence of installed software (e.g. browser plug-ins) or even the precise version number”.

The document defines criterion A and B to refer to the “carrying out the transmission” and “strictly necessary for a service explicitly requested by the user” exceptions, respectively.

  • For the specific case of first-party analytics purposes, WP29 notes:

    However, the Opinion also stated that currently there is no exemption to consent for cookies that are strictly limited to first party anonymised and aggregated statistical purposes. Therefore, first-party website analytics through device fingerprinting do not fall under the exemption defined in CRITERION A or B and consent of the user is required.

  • Similarly, for a user tracking for online behavioural advertising use case, WP29 states:

    Opinion 04/2012 emphasised that third-party advertising does not fall under the exemption defined in CRITERION A or B. Therefore, device fingerprinting for the purpose of targeted advertising requires the consent of the user.

The Opinion 04/2012 (PDF) discusses these “cookie consent exceptions” in more detail, but of course this is more general than cookies and applies equivalently to any JavaScript API. In the summary, they caution that the “strictly necessary” criterion must be interpreted narrowly:

When applying CRITERION B, it is important to examine what is strictly necessary from the point of view of the user, not the service provider.

These guidelines are rather dated, but since ePrivacy has remained essentially unchanged since then the WP29 guidelines and opinions are still the most authoritative discussion of these matters. The only relevant change is that the GDPR changed the definition of consent. The ePrivacy directive leaves no room for national derogations from the consent exception, though some countries like the Netherlands and (until 2021) Germany do provide exceptions. However, it is expected that the ePrivacy Directive will eventually be replaced by an ePrivacy Regulation that allows for access in case of a legitimate interest, similar to the more flexible approach chosen by the GDPR. It is also worth noting that this aspect of the ePrivacy Directive is not an enforcement priority for many supervisory authorities.

2
  • Hmm, in the examples you showed, the information was: 1) potential PII and 2) sent back to the server. These are not required elements, right?
    – Per R
    Jul 1, 2022 at 11:07
  • @PerR Those are not required elements. For ePrivacy Directive Art 5(3), the only relevant aspect is that information is being stored or accessed on the end user's device. It doesn't matter whether the data is communicated externally. It doesn't matter if the information also happens to be personal data. Thus, under a narrow interpretation as the one suggested by WP29 in Opinion 9/2014, any use of JavaScript APIs could require consent, unless Criterion A or B provides an exception.
    – amon
    Jul 1, 2022 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .