Articles

Working Party 29 guidance on cookie consent

Working Party 29 guidance on cookie consent

Working Party 29 guidance on cookie consent

14.10.2013

The Article 29 Working Party ("WP29") published a working document on how consent for cookies may be obtained. The WP29's opinions and working documents provide authoritative guidance on EU data protection rules.

Based on the e-Privacy Directive 2002/58/EC, the use of cookies or similar tracking technologies may require a website user's consent. The manner in which consent must be obtained varies per EU Member State. This WP29 [1] document provides guidance on obtaining consent for a website operating across Member States. To access the document, click here
 
1.  Consent 

The WP29 advises that a website should contain a mechanism that satisfies each of the following main elements for valid consent:

consent must be specific and based on appropriate information, including e.g. the purposes of the cookies;
consent must be provided before the cookies are set or read;
a positive response or other active behavior of the user is required; and
on the entry page the user should be provided with a real and meaningful choice to freely accept all, some or no cookies. 
 
2.  Consent mechanism 

According to the WP29, a website should contain:

  • an immediately visible notice informing whether various types of cookies are being used, providing the information in a so-called 'layered approach';
  • an immediately visible notice informing that by using the websites, the user agrees to cookies being placed and read by the websites;
  • information explaining how the user can express and later withdraw cookie consents;
  • a mechanism by which the user can choose to accept all or some or decline cookies; and
  • an option for the user to subsequently change a prior preference regarding cookies. 

3.  Layered approach to information and consent 
 
The WP29 in this working document confirms the notion of layered information approach (information to be provided layer by layer upon request of the user) and various consent options as introduced in previous documents. In this working document, the WP29 confirms that a user should not only be informed about the various categories of cookies, but also be able to choose which categories it allows or declines.

Furthermore, the WP29 advises that access to a website should not be made conditional on acceptance of all cookies. If the user does not accept cookies, the user should not be denied access, but may be offered access to less content of the website. 
 
4.  Tracking cookies 

Specific mention is made of tracking cookies. When tracking cookies are being used to single people out, such as by creating profiles based on behaviour, such data likely are personal data according to the WP29. The WP29 advises that for the processing of such personal data together with reading and setting of tracking cookies, the unambiguous consent of the user is obtained. Whether such consent is validly obtained  will be assessed by the competent national data protection authorities. 
 
5.  Conclusion 

With the guidance provided in this working document, the national authorities will have practical guidelines to verify compliance and enforce the rules regarding consent for cookies.

Footnotes:

1Representatives of the European data protection authorities, the European Data Protection Supervisor and the European Commission

Team

Related news

02.10.2019 EU law
Seminar: Data protection implications of (a no-deal) Brexit

Seminar - On October 2nd at 4 pm, we organize a seminar where we will discus the implications of a (no-deal) Brexit on data protection.  These issues affect all businesses interacting between UK and EEA (including EU) and which send or receive data to and from UK. We will highlight the main challenges both in the case of a hard Brexit on 31 October 2019 and in other scenarios. We will also offer guidelines to help your organisation mitigate the respective risks.

Read more

19.08.2019 EU law
Enable “likes” and bear joint-controllership

Articles - The Court of Justice of the European Union recently ruled, in Case C-40/14 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV,  that a website operator that features “Like” social-media plugin from Facebook likely qualifies as joint-controller with Facebook for its website visitors’ personal data collection and transmission to Facebook.

Read more

28.08.2019 NL law
Masterclass: e-signature and electronic identifiers

Masterclass - Stibbe is organising a Masterclass on 26 September 2019 in Amsterdam on the subject of e-signature and electronic identifiers. This Masterclass will cover the legal framework and focus especially on the numerous possibilities for applying the various electronic signatures in different situations. In addition, we explain the regulations governing electronic identifiers, and the mandatory European recognition they receive.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring