'Most Innovative Startup 2020' by RSA - Watch the video
Learn MoreBlogs
Published on February 15, 2021 AUTHOR PRIVACY RESEARCH TEAM
With the increasing use of cookies and similar tracking technologies, data privacy laws all around the world are increasingly requiring organizations to obtain user’s consent before the use of such technologies. Consider the opt-in consent regime of the European Union, which requires organizations to not load any non-essential cookies on their web pages unless and until they have displayed the cookie consent banner and users have accepted the use of cookies.
On 10 December 2020, the Italian data protection authority (Garante) also revised its guidelines on the use of cookies and similar tracking technologies. These Guidelines were opened for public consultation for 30 days and are now expected to be effective soon.
Some of the key points of the new Guidelines are set out below:
Privacy-by-design refers to integrating data protection considerations in the design stage. Privacy-by-default, on the other hand, requires organizations to ensure, by default, that the strictest privacy setting is available to the user. Garante reaffirms these two principles, as set out in the General Data Protection Regulation (GDPR), and requires organizations to not drop any non-essential cookies or other tracking technologies without obtaining the user’s consent. Similarly, organizations should not make use of cookie walls or pre-selected checkboxes to obtain the user’s consent and all non-essential cookies must be disabled by default.
Garante recognises that there are two main categories of cookies: technical cookies and profiling cookies.
Garante identifies that analytics cookies can be considered technical cookies under certain circumstances and would therefore not require the user’s prior consent. In that case, the use of such analytics cookies must be able to create a reasonable uncertainty as to the identity of the user. This is usually obtained by integrating the structure of the IP address within the cookie and masking portions of the same IP address. Such data minimization measures significantly reduce the identifying power of analytics cookies, and therefore, the cookies can be classified as technical cookies.
Garante’s new Guidelines apply equally to cookies and passive identifiers such as fingerprinting. The Italian data protection authority recognises that fingerprinting is the most common and increasingly used passive identifier to identify users’ devices, build users’ profiles, analyse their behavior, and display personalised advertisements. However, unlike cookies, the user is unable to directly and independently stop the profiling in case of the use of fingerprinting but instead, the user has to resort to the data controller.
In general, scrolling down a website, inactivity on the part of the user, or any other similar action does not constitute valid user’s consent for the use of cookies and other tracking technologies. However, when scrolling down a website is part of a complex series of actions which generates a specific pattern clearly showing the choice of the user to the website manager, it can be considered an unequivocal consent of the user to the use of cookies and other tracking technologies. Website managers are encouraged to make use of advanced methods based on the “dynamic web” to express consent, rather than using traditional virtual buttons. However, users must be informed of the use of such alternative methods.
To ensure that the user is provided with an equal option of accepting the use of cookies and withdrawing it, organizations must use buttons of the same size, emphasis, and colors. The buttons must be equally easy to see and use to ensure that the user is not influenced by the design choice. Garante recommends organizations to display granular and layered information in cookie consent banners. The first information layer of the cookie consent banner must include the following:
The extended cookie policy, on the other hand, must consist of all of the information required to be presented under Articles 12 and 13 of the GDPR. This includes the following information:
Organizations are not required to recollect consent at every visit of the website user. However, they must record consent to be able to demonstrate that valid consent has been obtained from the user. Organizations must reaffirm a user’s consent where the conditions of the collection of consent have changed or if they are not aware that cookies have already been installed on the user’s device in order to be re-transmitted.
Overall, the new Guidelines align with the GDPR which requires organizations to process personal data lawfully, fairly, and transparently. The Guidelines also adhere to the requirements of the e-Privacy Directive and the European Data Protection Board’s guidelines on consent, released on 4 May 2020.
Organizations are now encouraged to bring their cookie consent practices and cookie consent banners in line with the new Guidelines to avoid the imposition of any fines or penalties.
Securiti’s Cookie Consent Management solution enables organizations to build cookie consent notices in accordance with the applicable legal requirements with cookie auto-blocking, periodic scanning, and preference center features. Ask for a DEMO to understand how Securiti can help you comply with Italy’s updated guidelines on consent, GDPR, and a whole host of other global privacy laws and regulations, with ease.
Automate and manage the entire consent life cycle with efficiency for various cookie compliance regulations around the world.
Learn MoreDiscover granular insights into all aspects of your privacy and security functions while reducing security risks and lowering the overall costs
Learn MoreSimplify gathering information, dynamically update your data catalog, and automate assessments and reports
Learn MoreMeet Brian Lillie, Former CPO at Equinix as he discusses the potential challenges of CCPA and how the PrivacyOps framework can be the key to unlocking compliance.
Learn MoreWatch the 3-minute pitch presented by Rehan Jalil on SECURITI.ai in the RSAC Sandbox Competition
Learn MoreCCPA protects consumers from mismanagement of their personal data and gives the consumer control over what data is collected, processed, shared or sold.
Learn More
[email protected]
PO Box 13039,
Coyote CA 95013