Does the ePrivacy directive apply to general JavaScript code?

Question

Sweden have a "cookie law" that requires constent for non-necessary cookies. But the law seems way more general.

Information may be stored in or accessed from a subscriber's or user's terminal device on if the subscriber or user gets access to information about the purpose of the processing and consents to it. This does not prevent such storage or access that are required for the transmission of an electronic message through an electronic communication net or that is necessery to provide a service that the user or subscriber expressly has requested.

Riksdagen - Lagen om elektronisk kommunikation 6 kap 18§ (my translation).

Does the cookie law also apply to the use of JavaScript? For example, given this code:

var advertising = getAdvertising();
showAd(advertising);

Do I require consent before serving that code? Why or why not?

Answer 1

Yes, the ePrivacy Directive is way more general than cookies. The translated Swedish law seems close to the original in the ePrivacy Directive:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent […]. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

(from Art 5(3) ePrivacy Directive)

So, the general question when you access some JavaScript API is: what is the purpose of this access?

• Is the access necessary for performing a service that the user explicitly requested? Then fine. For example, reading the browser window size or device class for the purpose of providing an appropriate layout is fine, because the user explicitly requested you to show them the website. Using LocalStorage to store user data for an offline-capable webapp is perfectly fine.

• Otherwise, you will need consent. For example, reading the browser window size or device class for the purpose of better ad targeting would require consent, because the user did not explicitly request that you show them targeted ads. The user requested to see a website, and showing ads is not strictly necessary for that. Similarly, using any technologies that access or storage on the user's device to access, store, infer, or construct an advertising ID would require consent.

The WP29 has discussed this aspect of the ePrivacy Directive in their Opinion 9/2014 on device fingerprinting (PDF). They explicitly note that “JavaScript objects (e.g., document, window, screen, navigator, date and language)” can be used to form a fingerprint, for example by accessing “information relating to the screen size, colour depth and available system fonts. Other APIs may request access to information elements stored in the firmware (e.g. the CPU type), operating system (e.g. the OS type) or graphics card model. API calls may also reveal the presence of installed software (e.g. browser plug-ins) or even the precise version number”.

The document defines criterion A and B to refer to the “carrying out the transmission” and “strictly necessary for a service explicitly requested by the user” exceptions, respectively.

• For the specific case of first-party analytics purposes, WP29 notes:

  However, the Opinion also stated that currently there is no exemption to consent for cookies that are strictly limited to first party anonymised and aggregated statistical purposes. Therefore, first-party website analytics through device fingerprinting do not fall under the exemption defined in CRITERION A or B and consent of the user is required.

• Similarly, for a user tracking for online behavioural advertising use case, WP29 states:

  Opinion 04/2012 emphasised that third-party advertising does not fall under the exemption defined in CRITERION A or B. Therefore, device fingerprinting for the purpose of targeted advertising requires the consent of the user.

The Opinion 04/2012 (PDF) discusses these “cookie consent exceptions” in more detail, but of course this is more general than cookies and applies equivalently to any JavaScript API. In the summary, they caution that the “strictly necessary” criterion must be interpreted narrowly:

When applying CRITERION B, it is important to examine what is strictly necessary from the point of view of the user, not the service provider.

These guidelines are rather dated, but since ePrivacy has remained essentially unchanged since then the WP29 guidelines and opinions are still the most authoritative discussion of these matters. The only relevant change is that the GDPR changed the definition of consent. The ePrivacy directive leaves no room for national derogations from the consent exception, though some countries like the Netherlands and (until 2021) Germany do provide exceptions. However, it is expected that the ePrivacy Directive will eventually be replaced by an ePrivacy Regulation that allows for access in case of a legitimate interest, similar to the more flexible approach chosen by the GDPR. It is also worth noting that this aspect of the ePrivacy Directive is not an enforcement priority for many supervisory authorities.