The Requirements of Traficom Guidelines
The cookie guidelines of Traficom set out requirements for website operators and mobile application operators. The guidelines also cover similar tracking technologies, including session and local storage, tracking pixels, web beacons, tags, and fingerprinting technologies.
1. Non-essential cookies require prior consent.
Requesting consent from users is not required for placing essential cookies on users’ devices. For example, when 1) the sole purpose of storing and using the data is to enable the transmission of messages in communications networks, or 2) the storage and use of the data is necessary for the service provider to provide a service that the subscriber or user has specifically requested.
2. Legitimate interest cannot be a ground for cookie usage.
Legitimate interest does not authorize the storing or use of cookies. Section 205 of the Finnish Act on Electronic Communications Services (917/2014) and its underlying Article 5(3) of the ePrivacy Directive do not recognize legitimate interest as a basis for storing or using cookies on users’ devices.
3. Consent must be freely given, specific, informed, and unambiguous.
In order to be valid, consent must fulfill the conditions laid down in the GDPR - freely given, specific, informed, and unambiguous. Consent must be an active expression indicating the data subject’s wish. Silence, pre-ticked boxes, or inactivity (i.e., scrolling, swiping) should not constitute consent.
4. Rejecting cookies must be as easy for the user as it is to give consent.
Refusing to give consent must be as uncomplicated as granting consent. For example, if an “Accept or Allow all” selection is offered for granting consent for all non-essential cookies on the cookie banner, a similar option to continue using the service only with essential cookies (i.e., “Accept only essential cookies” button) or to withdraw consent for non-essential cookies should also be offered.
5. Withdrawing cookies must be as easy as giving consent.
According to the GDPR, users must be able to withdraw their consent at any time. Withdrawing consent or changing settings set earlier by a user must be as simple for the user as giving consent. For example, if consent is obtained through a single mouse click, screen swipe, or button press, users must be able to refuse or withdraw consent just as easily.
6. Pre-ticked boxes are not lawful.
Cookie banners may not include pre-ticked boxes or pre-selected slide bars for non-essential cookies. Therefore, non-essential cookies may not be turned on by the website by default, and the user must explicitly agree to their use by clicking on them (opt-in).
7. Consent cannot be bundled into the Terms of the website.
The general terms and conditions of the website cannot be a method to obtain consent. Obtaining consent must be a separate action containing a freely given, informed, specific and unambiguous expression of will.
8. Provide information about the cookies.
Users must be informed of the use and storage of cookies comprehensively and understandably. This information must be provided when the user makes the decision on granting, rejecting, or withdrawing consent.
It is also recommended to inform users of cookies even when only essential cookies are used, and no consent is legally required.
Cookie banners should, at minimum, specify the following:
- whether cookies are used;
- The types of cookies are used (i.e., essential, functional, personalization, advertising, social media, analytics, others);
- the purpose of each cookie (i.e., what data is collected with the cookie and for what purpose);
- the validity period of each cookie;
- information on whether data collected through cookies is shared with third parties, who the third parties are, and what data is transmitted.
In addition to this, the cookie banner may include more specific information or a link to more specific information relating to the cookies or privacy policy of the website.
9. Cookie walls are not allowed.
The mechanism used to request consent (i.e., a cookie banner) should not disproportionately disrupt or prevent the user from accessing the website. If the user continues to access the website without making the choices concerning cookies, the website must only use essential cookies by default. Therefore, it is inappropriate to use the acceptance of non-essential cookies as a precondition for accessing the website, as the consent cannot be considered voluntary (freely given) in this case.
10. Referring to browser settings for rejecting cookies is not lawful.
Browser settings cannot be considered sufficient indications of consent. This is because the user may not be able to configure the settings according to their preferences. Besides, configuring browser settings cannot be considered a sufficiently individualizing and active expression of will for the purpose of accepting cookies that can be used to collect data for a variety of purposes.
11. Consent must be demonstrable.
When requesting consent for placing cookies, it is appropriate to save the user’s choices to ensure that consent does not need to be constantly requested while the user navigates the website (“consent fatigue” must be avoided). Saving the choices made through the cookie banner may require the page to store a cookie that remembers the user’s choices on the user's device.
The website operator must later be able to prove that they have requested and obtained consent for placing cookies on the user’s device. To prove consent, at least the following data must be stored:
- date and time when consent was requested and obtained
- how consent was requested
- what information was provided to request consent, and
- the credentials that identify by whom and or from which device consent was given
