IDC Names Securiti a Worldwide Leader in Data Privacy


Italy’s New Guidance on Cookies and Similar Tracking Technologies

Published February 15, 2021 / Updated November 21, 2023

Listen to the content

With the increasing use of cookies and similar tracking technologies, data privacy laws  all around the world are increasingly requiring organizations to obtain user’s consent before the use of such technologies. Consider the opt-in consent regime of the European Union, which requires organizations to not load any non-essential cookies on their web pages unless and until they have displayed the cookie consent banner and users have accepted the use of cookies.

On 10 December 2020, the Italian data protection authority (Garante) also revised its guidelines on the use of cookies and similar tracking technologies. These Guidelines were opened for public consultation for 30 days and are now expected to be effective soon.

Some of the key points of the new Guidelines are set out below:

Privacy-by-design and Privacy-by-default

Privacy-by-design refers to integrating data protection considerations in the design stage. Privacy-by-default, on the other hand, requires organizations to ensure, by default, that the strictest privacy setting is available to the user. Garante reaffirms these two principles, as set out in the General Data Protection Regulation (GDPR), and requires organizations to not drop any non-essential cookies or other tracking technologies without obtaining the user’s consent. Similarly, organizations should not make use of cookie walls or pre-selected checkboxes to obtain the user’s consent and all non-essential cookies must be disabled by default.

Learn more about Privacy-by-Design and Privacy-by-Default

Technical and Profiling cookies

Garante recognises that there are two main categories of cookies: technical cookies and profiling cookies.

  1. Technical cookies are used for the sole purpose of transmitting a communication over a network of electronic communication or to the extent strictly necessary to provide the service explicitly requested by the user. Data controllers that use only technical cookies are exempted from the obligation to obtain user’s consent but they must provide general information to users about the use of such cookies.
  2. Profiling cookies are used to identify individuals, build their profiles, analyse their behavior, and send them targeted and personalised advertisements. Data controllers must obtain user’s consent before the use of such cookies.

Analytics cookies

Garante identifies that analytics cookies can be considered technical cookies under certain circumstances and would therefore not require the user’s prior consent. In that case, the use of such analytics cookies must be able to create a reasonable uncertainty as to the identity of the user. This is usually obtained by integrating the structure of the IP address within the cookie and masking portions of the same IP address. Such data minimization measures significantly reduce the identifying power of analytics cookies, and therefore, the cookies can be classified as technical cookies.

Active and Passive identifiers

Garante’s new Guidelines apply equally to cookies and passive identifiers such as fingerprinting. The Italian data protection authority recognises that fingerprinting is the most common and increasingly used passive identifier to identify users’ devices, build users’ profiles, analyse their behavior, and display personalised advertisements. However, unlike cookies, the user is unable to directly and independently stop the profiling in case of the use of fingerprinting but instead, the user has to resort to the data controller.


In general, scrolling down a website, inactivity on the part of the user, or any other similar action does not constitute valid user’s consent for the use of cookies and other tracking technologies. However, when scrolling down a website is part of a complex series of actions which generates a specific pattern clearly showing the choice of the user to the website manager, it can be considered an unequivocal consent of the user to the use of cookies and other tracking technologies. Website managers are encouraged to make use of advanced methods based on the “dynamic web” to express consent, rather than using traditional virtual buttons. However, users must be informed of the use of such alternative methods.

To ensure that the user is provided with an equal option of accepting the use of cookies and withdrawing it, organizations must use buttons of the same size, emphasis, and colors. The buttons must be equally easy to see and use to ensure that the user is not influenced by the design choice. Garante recommends organizations to display granular and layered information in cookie consent banners. The first information layer of the cookie consent banner must include the following:

  • Minimum information on the use of technical and profiling cookies,
  • A link to the privacy policy or extended information located in the second information layer,
  • An indication that the continuation of the navigation through a positive and unequivocal action will constitute the user’s consent, provided that such action is freely given, specific, informed, and unambiguous,
  • The possibility of consent to the use of all cookies and other tracking technologies,
  • A link to a webpage whereby the user can make granular cookie choices based on cookie purposes, as to the functionalities, the third parties and the categories of cookies to be installed,
  • A command to close the banner and deny consent to the use of cookies and other tracking technologies.

The extended cookie policy, on the other hand, must consist of all of the information required to be presented under Articles 12 and 13 of the GDPR. This includes the following information:

  • Data controller’s name and identity,
  • Data processors’ names and identities,
  • Recipients or categories of recipients of personal data,
  • Purposes of data processing,
  • Retention periods for personal data,
  • Information on how users can exercise their rights under the GDPR including the right to make an access request,
  • Information on appropriate safeguards and any potential risks in relation to cross-border data transfers,
  • Information to lodge a complaint to the supervisory authority.

Organizations are not required to recollect consent at every visit of the website user. However, they must record consent to be able to demonstrate that valid consent has been obtained from the user. Organizations must reaffirm a user’s consent where the conditions of the collection of consent have changed or if they are not aware that cookies have already been installed on the user’s device in order to be re-transmitted.

Overall, the new Guidelines align with the GDPR which requires organizations to process personal data lawfully, fairly, and transparently. The Guidelines also adhere to the requirements of the e-Privacy Directive and the European Data Protection Board’s guidelines on consent, released on 4 May 2020.

How Securiti can help?

Organizations are now encouraged to bring their cookie consent practices and cookie consent banners in line with the new Guidelines to avoid the imposition of any fines or penalties.

Securiti’s Cookie Consent Management solution enables organizations to build cookie consent notices in accordance with the applicable legal requirements with cookie auto-blocking, periodic scanning, and preference center features.

Privacy Center
Fully Functional In Minutes

Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.


Ask for a DEMO to understand how Securiti can help you comply with Italy’s updated guidelines on consent, GDPR, and a whole host of other global privacy laws and regulations, with ease.

Anas Baig

Authored by Anas Baig

Anas Baig is a Product Marketing Manager with a proven track record in the cybersecurity industry. He has been a prominent contributor to numerous esteemed publications, including Infosecurity Magazine, CSO Online, Tripwire, Security Affairs, Network Computing, Security Boulevard, and several other renowned cybersecurity blogs.His in-depth knowledge and extensive experience in the industry make him a trusted source for cutting-edge insights and information in the ever-evolving world of cybersecurity.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


More Stories that May Interest You

At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.


Gartner Cool Vendor Award Forrester Badge IAPP Innovation award 2020 IDC Worldwide Leader RSAC Leader CBInsights Forbes Security Forbes Machine Learning G2 Users Most Likely To Recommend