Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

The Ultimate Guide to Cookie Laws & Regulations

Download: Consent Report Q2 2024
Published July 12, 2021 / Updated January 8, 2024
Contributors

Anas Baig

Product Marketing Manager at Securiti

Maria Khan

Data Privacy Legal Manager at Securiti

FIP, CIPT, CIPM, CIPP/E

Listen to the content

On every website you ever visit, you probably have had to accept or decline certain cookies via a cookie notice or banner. Some of those cookies are there to track your browsing activities and can be traced back to your browser. They are also storing your data which can be seen as a threat if not secured properly. Global privacy regulations are coming up with rules for organizations to abide by when collecting personal data via cookies and processing these cookies for various purposes.

The GDPR focuses on organizations collecting freely given consent from their customers before they store or process any of their personal data, which includes dropping cookies on their website. Websites and apps that are used by visitors from the EU must implement a consent banner that complies with GDPR, and it has to have several pieces in place.

Under the GDPR, customers need to be fully informed about the types of cookies that are being stored and why they are being stored before the consumer can give them consent. Under the GDPR, consent needs to be:

  1. Freely-given
  2. Specific
  3. Informed
  4. Unambiguous

The GDPR requires organizations to have the following included in their cookie policy:

  • What information is collected
  • What you do with consumer information
  • How you protect consumer information
  • If you disclose any information to third parties
  • How you store consumer information
  • How users may access, migrate, request rectification, restriction or deletion of information

The GDPR and e-Privacy Directive both aim to ensure an appropriate level of confidentiality and security of European Union Residents' data.

The e-Privacy Directive provides a guideline on cookies which is why it was originally known as the “cookie law”. This is not the case with the GDPR as it does not explicitly state any guidelines or requirements based on cookies. The e-Privacy Directive requires organizations to provide comprehensive and easily understandable information with regards to the processing of cookies. These organizations must acquire the informed consent of users before tracking them with cookies. Although the GDPR does not mention cookies specifically, it classifies cookies as an “online identifier,” meaning that it may be considered personal data under certain circumstances.

Read more about EU Cookie Laws

Impact of the EU Guidelines on the U.S.

The E-Privacy Directive does not have a clear extraterritorial scope, which means that if a company does not have any physical presence or operation in the EU, they do not need to comply with the cookie guidelines.

On the other hand, the GDPR has clear extraterritorial scope. It covers the processing of personal data within the EU as well as outside the EU if the organization is offering goods and services to EU data subjects. If an organization's website targets EU consumers in accepting e-commerce payments in Euros as an alternative to U.S. dollars, or if the site's use of cookies amounts to intentionally "monitoring" the behavior of visitors who are in the EU, the GDPR likely applies to the organization.

PII and Cookies

PII (Personally Identifiable Information):

Under Article 9 of the GDPR, sensitive data is defined as the following:

  • personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs;
  • trade-union membership;
  • genetic data, biometric data processed solely to identify a human being;
  • health-related data;
  • data concerning a person’s sex life or sensitive data.

Cookie/online identifiers:

Although the GDPR does not talk about cookies specifically, it does mention “online identifiers under Article 4, recital 30 of the GDPR. The article states:

“Natural persons may be associated with online identifiers provided by their devices, applications, tools, and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.” 

Penalties Due to Non-Compliance

The EU cookie legislation depends on the government to set specific penalties for noncompliance. Here are some of the penalties an organization can face due to non-compliance:

  1. Regulators can request organizations for information that is stored in the website. This may include:
    1. Types of cookies your site uses
    2. Links to the cookie information section
    3. Identifiers of compliance
  2. Regulators can ask organizations to make changes to help them be more compliant with the EU guidelines. This can be requested or even enforced to be done in a set amount of time.
  3. Depending on the country, the organization can face a monetary fine based on the severity of non-compliance.

Schedule Your
Personal Demo

Learn how you can leverage Securiti’s Data Command Center to address data security, privacy, governance, and compliance.

See a demo
Schedule your demo today

Compliance Checklist

There are several ways in which an organization can simplify their compliance practices. Here are a few steps that can be taken in order to make this process easier.

Improve Privacy Policy

The first step towards staying compliant with cookie laws is to understand your privacy policy and revamp it based on guidelines and regulations. The GDPR contains stringent regulations regarding an organization’s privacy policy, how it must be written, what it must contain, and how it must be accessed.

Audit Databases

Organizations will need to audit their databases for opt-in consent. The GDPR is an Opt-In consent regime and it is paramount to obtain explicit consent from an individual before processing their data.

Create an Opt-In Process

For any new contact details, organizations need to ensure a process to gather the required level of opt-in for each new entry. GDPR stipulates that consent from consumers must now be gathered by them actively opting-in, rather than them having to opt-out.

Review Third Party Access

Third-party access can be one of the major threats to compliance because your organization may get penalized for someone else’s negligence. It is important to review what third parties you share data with, how they use it, and what their GDPR policies are.

Streamline DSR Fulfilment

GDPR regulations require organizations to respond to a consumer’s "request for information" within one month at the latest.

How Securiti Can Help?

Organizations are required under law to protect a consumer's data and obtain consent before collecting or storing any of this data. Securiti's PrivacyOps approach enables organizations to fulfill cookie requirements with the help of robotic automation and artificial intelligence. Here is how it can help:

  1. Automatic Scanning:
    In order to manage cookies in an effective manner, the first step is to keep track of all your cookies. Securiti helps track and classify cookies on your digital properties (i.e desktop, mobile websites) through automatic scanning.
  2. Customizable Cookie Banners:
    Securiti offers a cookie banner to capture freely given consent from the consumer. These banners can then be customized to your company’s branding guidelines.
  3. Consent Revocations:
    Under European law, consumers have the right to revoke their consent at any time. Securiti offers a preference center that simplifies the process of revoking consent and honoring the revocation.
  4. Demonstrate Compliance:
    Securiti maintains comprehensive records of consent for compliance reporting and audit trail.

Conclusion

Consumers' data being tracked by third-party entities via cookies can be deemed a privacy threat. Privacy regulations are in place to ensure that this data is handled in a safe and ethical manner, meaning nothing can be processed without the consumer's freely given consent. This will, in turn, protect the consumer's privacy and give organizations a reason to adopt a first-party approach when trying to obtain consumers' data.

Data is growing at an exponential rate, and keeping track of all this data is becoming a virtually impossible task with each passing day.  Automation is necessary, now more than ever, for any organization that is hoping to comply with privacy regulations in a scalable way.

To learn more about how Securiti can help, request a demo.

Frequently Asked Questions

Cookie compliance rules are primarily outlined in the ePrivacy Directive and the GDPR. They require websites to obtain informed consent for placing non-essential cookies and provide users with clear information about the types of cookies used.

The cookie law in the EU primarily refers to the ePrivacy Directive, which governs the use of cookies and similar technologies. It requires websites to obtain users' informed consent for non-essential cookies and protect users' privacy.

GDPR stipulates that cookies, especially non-essential ones, should only be placed on a user's device with their informed and unambiguous consent. Website operators must provide clear information about the types of cookies used, their purpose, and any data collected. Users have the right to withdraw their consent at any time, which should be as easy as giving consent. It's essential to maintain compliance with these rules to ensure user data privacy and avoid potential penalties.

The regulation surrounding cookie consent is primarily defined by GDPR and the ePrivacy Directive. Under these rules, obtaining user consent for the use of cookies is crucial. Consent should be freely given, specific, informed, and an unambiguous indication of the user's wishes. Websites must provide clear and comprehensive information about their cookie usage and allow users to make choices easily. This regulation aims to put users in control of their online privacy and ensure they have a say in how their data is used.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share

More Stories that May Interest You
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Spotlight 13:32
Ensuring Solid Governance Is Like Squeezing Jello
Watch Now View
Latest
View More
Databricks AI Summit (DAIS) 2025 Wrap Up
5 New Developments in Databricks and How Securiti Customers Benefit Concerns over the risk of leaking sensitive data are currently the number one blocker...
Inside Echoleak View More
Inside Echoleak
How Indirect Prompt Injections Exploit the AI Layer and How to Secure Your Data What is Echoleak? Echoleak (CVE-2025-32711) is a vulnerability discovered in...
What Is Data Risk Assessment and How to Perform it? View More
What Is Data Risk Assessment and How to Perform it?
Get insights into what is a data risk assessment, its importance and how organizations can conduct data risk assessments.
What is AI Security Posture Management (AI-SPM)? View More
What is AI Security Posture Management (AI-SPM)?
AI SPM stands for AI Security Posture Management. It represents a comprehensive approach to ensure the security and integrity of AI systems throughout the...
Beyond DLP: Guide to Modern Data Protection with DSPM View More
Beyond DLP: Guide to Modern Data Protection with DSPM
Learn why traditional data security tools fall short in the cloud and AI era. Learn how DSPM helps secure sensitive data and ensure compliance.
Mastering Cookie Consent: Global Compliance & Customer Trust View More
Mastering Cookie Consent: Global Compliance & Customer Trust
Discover how to master cookie consent with strategies for global compliance and building customer trust while aligning with key data privacy regulations.
View More
Key Amendments to Saudi Arabia PDPL Implementing Regulations
Download the infographic to gain insights into the key amendments to the Saudi Arabia PDPL Implementing Regulations. Learn about proposed changes and key takeaways...
Understanding Data Regulations in Australia’s Telecom Sector View More
Understanding Data Regulations in Australia’s Telecom Sector
Gain insights into the key data regulations in Australia’s telecommunication sector. Learn how Securiti helps ensure swift compliance.
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
DSPM Vendor Due Diligence View More
DSPM Vendor Due Diligence
DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...
What's
New