Quantcast
Channel: PRIVACY EUROPE » cookies
Viewing all articles
Browse latest Browse all 6

29 WP adopts guidance on how to obtain consent for cookies

0
0

Consent requirements

In order to be valid consent must be informed, prior, freely given and engage an active behaviour from the data subject.

How consent shall be considered fully informed?

The following information should be provided:

(i)                  Purposes of the cookies

(ii)                If applicable, third party cookies (detailed) or third party access to data collected by the cookies

(iii)               Cookies expiry date

(iv)              Technical information

(v)                Cookies settings and changes to such settings.

The information should be provided in a clear, comprehensive and visible way, being acceptable that a prominently notice is placed in the homepage along with a link to the place where all the information above referred is available.

Article 29 WP makes clear that “blanket consent without specifying the exact purpose of the processing is not acceptable”.

When should (exactly) consent be obtained?

It should be obtained before they are set or read. Article 29 WP does not give any clues or examples. Instead it emphasis that the website must find a mechanism that ensures cookies are only placed after the data subject has made his/her choices as far as cookies are concerned, unless consent is exempted.

What could be considered an active choice of the data subject?

The consent should be unambiguous and Article 29 WP considers, without limitation, the following tools: splash screens, banners, modal dialog boxes and browser settings.

Nevertheless, highlights that website operator shall only rely on browser settings where it

can be confident that the user has been fully informed and actively configured their browser or other application then, in the right circumstances, such a configuration, would signify an active behaviour and therefore be respected by the website operator”.

The key to consider that an active choice has been taken is the one (examples provided by Article 29 WP: clicking on a button or link or ticking a box in or close to the space where information is presented) “from which a website operator can unambiguously conclude it means specific and informed consent”.

Again, Article 29 WP makes clear that this active choice/behaviour must be unmistakable to the data subject, i.e. he/she must understand that his/her active behaviour/choice will determine the use of the cookies and for the purposes duly informed. Thus, in Article 29 WP’s opinion “ensuring that the button, link or box which indicates the active behaviour is within or close to the location where information is presented is essential to be confident that the user can refer the action to the information prompted”.

Article 29 WP also stresses that “the information should be present on the website and not disappear until the user has expresses his/her consent” and advises that “absence of any behaviour cannot be regarded as valid consent”.

How to ensure that the choice of cookies is freely given?

The data subject should be provided with the possibility to accept or refuse all or some cookies as well as change the cookies settings at any time, particularly tracking cookies.

In this respect, Article 29 WP warns that “websites should not make conditional “general access” to the site on acceptance of all cookies but can only limit certain content if the user does not consent to cookies”.

This means that if cookies do not question the provision of the web services or goods but only represents an advantageous to the web operator, the data subject could still be able to use the website and declining such cookies.

Final remarks

Without being exhaustive this guidance is useful, gives additional information that website operators should bear in mind and shows the ways that should be followed or not when implementing a mechanism to obtain consent for placing cookies within the European Union.

Notwithstanding, Article 29 WP was silent on whether implicit consent on placing cookies is valid or not, being actually quite ambiguous because in some occasions it seems to claim that consent should be explicit and on others it seems to accept implicit consent.

Hopefully, national Data Protections Authorities will soon issue guidelines on obtaining consent for cookies, clarifying some of the issues that were not addressed by the Article 29 WP in a ceaseless quest to guide website operators as well as data subjects as far as cookies are concerned.

The post 29 WP adopts guidance on how to obtain consent for cookies appeared first on PRIVACY EUROPE.


Viewing all articles
Browse latest Browse all 6

Latest Images

Trending Articles





Latest Images