Cookie Consent Compliance
One of the main components of website compliance is cookie consent compliance. This is to ensure that cookies are not installed before consent is obtained from the user.
1.1. What is a cookie consent notice?
A cookie consent notice is a mechanism used to collect consent choices of your website visitors. It can be an opt-in cookie banner, pop-up, or box on the website that tells visitors that you are using cookies and other similar tracking technologies, present your cookie policy, and allows them to accept, deny or customize the use of cookies by your website.
1.2. Why would you need a cookie consent notice?
You need a cookie consent notice on your website for two crucial reasons. The first is that it is a direct or indirect requirement under the most robust data privacy and cookie laws worldwide. For example, the EU law requires websites to ask for the consent of their users before placing any cookies on their devices. A cookie consent notice on the websites, such as a cookie banner or a pop-up window, usually does this.
In addition, cookie consent notice helps to establish a trusting relationship between you and your users by building complete transparency. This transparency may show a strong bond between you and your users, and you help you generate more leads and make conversions.
1.3 What are the requirements relating to cookie consent notices?
Certain countries’ and regions' data privacy and cookie laws require a cookie consent notice. It is also used to comply with data protection laws that require prior consent to collect personal data. Below we will focus on the relevant laws of particular states or regions.
1.3.1 The requirements in the EU
The EU cookie law comprises the General Data Protection Regulation and the EU ePrivacy Directive, also known as the EU Cookie Directive. Besides, the European Data Protection Board (EDPB) Consent Guidelines and the Planet 49 case have complemented the legal framework.
The ePrivacy Directive requires websites to obtain prior consent before using cookies. Users must also be given clear and comprehensive information about the use of cookies and be offered an option to refuse the cookies easily. This does not prevent websites from placing the so-called “strictly necessary cookies” used solely to carry out or facilitate the transmission of a communication over an electronic communications network or as strictly necessary to provide an information society service explicitly requested by the user.
The banner shall appear on the first webpage of your website, where the user lands for the first time.
The GDPR gives users the right to be informed about collecting and processing data. Websites must provide users with information such as what data they gather, how long they retain it, which they share it with, etc.
The requirements of the GDPR and the ePrivacy Directive can be satisfied by using a cookie consent notice, such as a cookie banner. It is an easy and practical way of providing the necessary information to users before collecting their data, obtaining their consent, and allowing them to refuse to use cookies.
The EDPB Consent Guidelines provided clarity on some issues regarding cookies. In Particular, the EDPB stated that 1) the “cookie walls” are not lawful, and 2) scrolling/browsing cannot be relied on as a means of indication of consent.
The final primary EU cookie law framework source is the Planet 49 case. The Court of Justice of the European Union (CJEU) rendered a decision that sheds light on some crucial aspects of website cookie usage. According to the judgment of the CJEU:
- Pre-ticked checkboxes were declared invalid,
- When consent is required for the placement of cookies under the ePrivacy Directive, the GDPR standard of consent applies (freely given, specific, informed, and unambiguous),
- Consent cannot be bundled as it does not meet the “specificity” requirement under the GDPR, and thus websites must request consent for different cookie usage purposes (granular consent),
- The information must be given to visitors, including, among other matters, the duration of the cookie lifespan and whether third parties will have access to these technologies, the categories of third-party recipients of cookies, and,
- Whether the cookies constitute personal data, Article 5(3) of the e-Privacy Directive (the cookie consent rule) applies to any information placed or accessed from an individual’s device.
Some of the national Data Protection Authorities (DPA) of the EU Member States have also issued cookie-related guidelines. These cookie guidelines set out clarifications on various aspects of cookie usage by websites that are subject to the jurisdiction of particular DPAs. Compliance with national cookie guidelines is not mandatory but is strongly recommended for those who fall under the territorial scope of the relevant DPA. For example, CNIL Cookie Guidelines are appropriate for organizations established in France.
Based on the sources above of the EU cookie law framework, to comply with EU cookie laws, you must ensure that you satisfy the following minimum requirements, apart from any additional requirements set forth by national DPA cookie guidelines.
- Do not place cookies before obtaining consent from your users (“Strictly necessary cookies” are exempt from this rule).
- Provide your users with clear and comprehensive information about using cookies on your website.
- Ensure that the consent you obtain satisfies the GDPR consent standards (consent must be freely given, specific, informed, and unambiguous).
- Allow your users to refuse the use of cookies easily.
- Do not rely on scrolling/browsing as an indication of consent.
- Do not use cookie walls.
- Obtain separate consent for different cookie categories.
1.3.2 The requirements of the CCPA
In the absence of a data protection law passed on a federal level by the federal government, the main legislative act concerning data protection in California is the California Consumer Privacy Act (CCPA). The does not expressly require obtaining consent for the use of cookies. The only exception under the CCPA is to have prior consent from minors when selling their personal information through cookies. If they are between 13-16 years old, you must seek consent directly from them. If they are younger than 13, you must seek consent from their parents or guardians.
However, it must be emphasized that the CCPA does not require websites to obtain cookie consent before collecting data from minors but before selling their data. What counts as “selling” under the CCPA is defined as the act of “disclosing” or “making available” personal information “for monetary or other valuable consideration.”
While the definition of “sale” contains an exception for situations where information is shared with a service provider, it is debatable whether the exception applies when the data is shared with behavioral advertising networks. This is because behavioral advertising networks may not meet the three conditions of service provider exception under the CCPA:
- Firstly, the transfer of information to the service provider must be necessary for the business. It is debatable how necessary the transfer of personal information to behavioral advertising networks is for companies.
- Secondly, transferring data to behavioral advertising networks must be provided to the users. Due to the lack of legal consciousness, some businesses may knowingly fail to indicate this in their privacy policies.
- Thirdly, the agreement with the service provider must prohibit the secondary use of the data. However, these networks may be willing to continue using the data for other purposes.
Given all these, it is not 100 percent guaranteed that data transfer to behavioral advertising networks would benefit from service provider exceptions.
While prior cookie consent is not expressly required, to mitigate the risk that third-party behavioral advertising could be considered a “sale” under the CCPA, you are encouraged to obtain prior cookie consent from your users before placing third-party behavioral advertising cookies.
Other than the CCPA, another essential law relating to consumer privacy in California is the California Privacy Rights Act (CPRA), also called the “CCPA 2.0”. The CPRA was adopted in 2020, takes effect on 1 January 2023, and becomes fully enforceable on 1 July 2023 with a lookback period from 1 January 2022. Even though CPRA updates the CCPA in many aspects, its requirements regarding cookie consent remain the same as that of the CCPA.
1.3.3 The requirements in Canada
The cookies are regulated under various laws in Canada. This includes the Anti-Spam Legislation (CASL) and PIPEDA. Cookie consent is mainly regulated under the CASL.
CASL regulates, among other things, the installation of computer programs (i.e., cookies) on users’ devices. The main rule is to obtain their consent before placing any computer program on a user’s device. For example, a website is prohibited from automatically installing a computer program (or updating an existing program) on a user’s device before obtaining express consent. However, you must have express consent without asking for it in certain circumstances. This is the case for installing specific computer programs, including cookies. This means you do not have to request prior consent before deploying cookies on users’ browsers. However, if you want to rely on this exception, you must know that you are only considered to have consent for as long as the user’s conduct indicates that they consent to it. For example, if a user disables Javascript in their browser, or similarly, a user disables cookies in their browser, you cannot be considered to have consented to deploy cookies. More examples can be listed.
According to the CASL, if you want to rely on a prior consent exception, the main point is that the user’s conduct must be such that it is reasonable to believe that they consent to the installation of the cookies. As you can see, this exception may not always apply, and you may be acting in breach of CASL. That is why it may be wiser to have a cookie banner to collect prior cookie consent to ensure you don’t have to consider whether the exception applies to you.
When you request express prior consent to install a computer program, including cookies, you must set out the following:
- The reason you are seeking consent;
- Who is seeking consent (i.e., name of the company; or if consent is sought on behalf of another person, that person’s name);
- If consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is being sought;
- The mailing address and one other piece of contact information (i.e., telephone number, email address, or Web address);
- A statement indicating that the person whose consent is sought can withdraw their consent; and
- A description in general terms of the functions and purpose of the computer program to be installed.
It is also essential to be aware that you have the burden of proof of consent collection. This means that you must keep records of consent to prove compliance with CASL.
Another critical issue is that if a person withdraws their consent, you can no longer rely on that consent for future updates installed in the background.
1.3.4 The requirements in other privacy laws
Other data protection and privacy laws are also relevant for cookie consent requirements.
LGPD: Cookies are not explicitly addressed by the LGPD. However, since most cookies collect personal data, cookie deployment is subject to prior consent. The consent is considered valid under the LGPD if it is:
- Freely given
- Informed, specific, and unambiguous
- Given in writing
- Easily withdrawn
These conditions can be met by implementing a cookie banner on your website.
Read more about LGPD cookie banner requirements.
Thai PDPA: Under the Thai PDPA, you must ask for consent before collecting personal data. This also applies to cookies. Before cookies are placed on users’ browsers, you must ask for consent. Besides, when you request consent, it must be done in an easily understandable manner, which is non-deceptive and differs from other content on your website.
Read more about PDPA consent requirements here.
