On 26 October, Luxembourg’s data protection authority CNPD published new guidelines on the use of cookies and similar tracking technologies. This article provides an overview of the Guidelines that will help websites implement legally compliant cookie consent solutions.
Let’s look into some of the key points highlighted by the CNPD in this Guidelines:
No consent for essential cookies:
The user’s consent is not needed for the use of essential cookies or other corresponding technologies. Essential cookies are those that are either used to carry out the transmission of a communication over an electronic communications network or are strictly necessary for the provision of the services explicitly requested by the user. This includes cookies used for the following purposes:
- Recording user’s choice regarding cookies
- User authentication
- Saving shopping cart
- Saving responses to a contact form
- Streaming content when the user has indicated his/her desire to access the content concerned
- Customization of the service (e.g., to save a display format or a language setting)
- Security (fight against fraud, detection of multiple authentication attempts)
Even if consent is not required for the use of essential cookies, the CNPD recommends websites to inform users of their use and whether or not such cookies involve the processing of personal data. Where essential cookies involve the processing of personal data, the cookie banner must contain a link to a more detailed cookie policy or privacy policy, having all the mandatory information as required under Article 13 of the GDPR.
Consent for non-essential cookies:
All non-essential cookies and similar tracking technologies require the consent of the user. This includes cookies used for the following purposes:
- Tracking and profiling purposes
- Targeted advertising purposes or displaying personalised advertisements based on user’s profile
- Tracking geolocation of the user
- Social plugins if the plugin is linked to the use of cookies (for example, “like” buttons or other links in the pages of the website to be social networks)
Cookie banner requirements for non-essential cookies:
Consent for the use of non-essential cookies must be informed, freely-given, specific and unambiguous. The CNPD recommends websites to contain the following information in their cookie consent banners:
- First information layer:
- At a minimum, enable the user to understand that cookies are used, the purposes for which these are used, who are responsible for them (e.g., cookies specific to the site or third-party or both), the way cookies can be accepted and refused, the possibility of withdrawing consent at any time, and consequences of refusing consent where relevant
- A link to the second information layer (data protection policy or cookie policy separate from the general conditions)
- Second information layer (cookie policy):
- Technical information on cookies
- A detailed description of the purposes of cookies
- A precise and exhaustive list of parties responsible
- The categories of data collected via cookies
- The data recipients
- The operating time of cookies and retention periods
- Any data transfers to third countries via cookies
- The existence of automated decision-making including profiling, if applicable
No use of dark patterns:
For consent to be freely-given, the CNPD reminds data controllers to avoid the use of any dark patterns while obtaining consent from users. It provides the following list of dark patterns that must be avoided in all circumstances:
- The use of different forms or sizes of consent buttons, the use of large “I accept” and small “I refuse” button
- The use of different font sizes for accept and reject buttons
- The use of different colors for accept and reject buttons
- The use of different contrasts, e.g, “I accept” button in a strong contrast making it clearly visible while the “I refuse” button has very little contrast compared to the rest of the banner is hardly visible.
The idea is that data controllers must not mislead users, consciously or unconsciously, and present accept and reject choices in an identical manner. Moreover, users must be able to provide consent to cookies based on their purposes.
Withdrawal of consent:
Withdrawing consent must be as simple and easy as accepting cookies. Where the “I accept all” button is shown on the first information layer of the cookie banner, the “I refuse all” button must also be displayed on it. The CNPD emphasizes that the user must be able to withdraw consent, for example, by means of a clear link titled “Cookie Management” displayed at the bottom of each page or a floating icon.
Renewal of consent:
After the period of 12 months, consent must be requested again from the user. Consent may be requested earlier in case of any change of data categories, processing purposes, or any other significant change with respect to user’s choice. The CNPD also recommends maintaining records of consent in a time-stamped manner for the purposes of demonstrating compliance.
How Securiti can help?
Securti’s Cookie Consent Management Solution enables organisations to build cookie consent banners in accordance with the applicable legal requirements. It can help you comply with Luxembourg’s Guidance on cookies with the help of the following features:
