With the increasing use of cookies and similar tracking technologies, data privacy laws all around the world are increasingly requiring organizations to obtain user’s consent before the use of such technologies. Consider the opt-in consent regime of the European Union, which requires organizations to not load any non-essential cookies on their web pages unless and until they have displayed the cookie consent banner and users have accepted the use of cookies.
On 10 December 2020, the Italian data protection authority (Garante) also revised its guidelines on the use of cookies and similar tracking technologies. These Guidelines were opened for public consultation for 30 days and are now expected to be effective soon.
Some of the key points of the new Guidelines are set out below:
— Privacy-by-design and Privacy-by-default
Privacy-by-design refers to integrating data protection considerations in the design stage. Privacy-by-default, on the other hand, requires organizations to ensure, by default, that the strictest privacy setting is available to the user. Garante reaffirms these two principles, as set out in the General Data Protection Regulation (GDPR), and requires organizations to not drop any non-essential cookies or other tracking technologies without obtaining the user’s consent. Similarly, organizations should not make use of cookie walls or pre-selected checkboxes to obtain the user’s consent and all non-essential cookies must be disabled by default.
— Technical and Profiling cookies:
Garante recognises that there are two main categories of cookies: technical cookies and profiling cookies.
- Technical cookies are used for the sole purpose of transmitting a communication over a network of electronic communication or to the extent strictly necessary to provide the service explicitly requested by the user. Data controllers that use only technical cookies are exempted from the obligation to obtain user’s consent but they must provide general information to users about the use of such cookies.
- Profiling cookies are used to identify individuals, build their profiles, analyse their behavior, and send them targeted and personalised advertisements. Data controllers must obtain user’s consent before the use of such cookies.
— Analytics cookies
Garante identifies that analytics cookies can be considered technical cookies under certain circumstances and would therefore not require the user’s prior consent. In that case, the use of such analytics cookies must be able to create a reasonable uncertainty as to the identity of the user. This is usually obtained by integrating the structure of the IP address within the cookie and masking portions of the same IP address. Such data minimization measures significantly reduce the identifying power of analytics cookies, and therefore, the cookies can be classified as technical cookies.
— Active and Passive identifiers
Garante’s new Guidelines apply equally to cookies and passive identifiers such as fingerprinting. The Italian data protection authority recognises that fingerprinting is the most common and increasingly used passive identifier to identify users’ devices, build users’ profiles, analyse their behavior, and display personalised advertisements. However, unlike cookies, the user is unable to directly and independently stop the profiling in case of the use of fingerprinting but instead, the user has to resort to the data controller.
— Scrolling
In general, scrolling down a website, inactivity on the part of the user, or any other similar action does not constitute valid user’s consent for the use of cookies and other tracking technologies. However, when scrolling down a website is part of a complex series of actions which generates a specific pattern clearly showing the choice of the user to the website manager, it can be considered an unequivocal consent of the user to the use of cookies and other tracking technologies. Website managers are encouraged to make use of advanced methods based on the “dynamic web” to express consent, rather than using traditional virtual buttons. However, users must be informed of the use of such alternative methods.
— Cookie consent banners and granularity of information
To ensure that the user is provided with an equal option of accepting the use of cookies and withdrawing it, organizations must use buttons of the same size, emphasis, and colors. The buttons must be equally easy to see and use to ensure that the user is not influenced by the design choice. Garante recommends organizations to display granular and layered information in cookie consent banners. The first information layer of the cookie consent banner must include the following:
- Minimum information on the use of technical and profiling cookies,
- A link to the privacy policy or extended information located in the second information layer,
- An indication that the continuation of the navigation through a positive and unequivocal action will constitute the user’s consent, provided that such action is freely given, specific, informed, and unambiguous,
- The possibility of consent to the use of all cookies and other tracking technologies,
- A link to a webpage whereby the user can make granular cookie choices based on cookie purposes, as to the functionalities, the third parties and the categories of cookies to be installed,
- A command to close the banner and deny consent to the use of cookies and other tracking technologies.
The extended cookie policy, on the other hand, must consist of all of the information required to be presented under Articles 12 and 13 of the GDPR. This includes the following information:
- Data controller’s name and identity,
- Data processors’ names and identities,
- Recipients or categories of recipients of personal data,
- Purposes of data processing,
- Retention periods for personal data,
- Information on how users can exercise their rights under the GDPR including the right to make an access request,
- Information on appropriate safeguards and any potential risks in relation to cross-border data transfers,
- Information to lodge a complaint to the supervisory authority.
— Recollection of consent
Organizations are not required to recollect consent at every visit of the website user. However, they must record consent to be able to demonstrate that valid consent has been obtained from the user. Organizations must reaffirm a user’s consent where the conditions of the collection of consent have changed or if they are not aware that cookies have already been installed on the user’s device in order to be re-transmitted.
Overall, the new Guidelines align with the GDPR which requires organizations to process personal data lawfully, fairly, and transparently. The Guidelines also adhere to the requirements of the e-Privacy Directive and the European Data Protection Board’s guidelines on consent, released on 4 May 2020.
How Securiti can help?
Organizations are now encouraged to bring their cookie consent practices and cookie consent banners in line with the new Guidelines to avoid the imposition of any fines or penalties.
Securiti’s Cookie Consent Management solution enables organizations to build cookie consent notices in accordance with the applicable legal requirements with cookie auto-blocking, periodic scanning, and preference center features.
