- allowing only essential technical cookies to be implemented by default, and requiring user consent for all other cookies that are merely helpful or convenient;
- the need for the giving of consent to non-essential cookies be a clear and positive action, rather than being given, for example, by way of a pre-ticked box or by continued use of a site;
- preventing consent bundling whereby consent is given in one click for cookies used for more than one purpose without granular controls; and
- making the withdrawal of consent to cookies as easy as giving consent.
Alongside this increasing prevalence of regulatory guidance on cookies, there has been a wave of letters from activists to companies pointing out apparent shortcomings in compliance, and a corresponding increase in the submission of complaints to national data protection authorities across Europe. Notably, noyb recently sent a second wave of two hundred and seventy draft cookie banner complaints to website operators across Europe. This follows from the initial batch of over five hundred letters sent by the same organisation in May 2021.
Complaints from activist groups such as noyb have focused on the following practices by website operators:
- inaccurately classifying certain cookies as “essential”;
- using pre-ticked boxes to obtain consent for cookies;
- making accepting cookies easier than rejecting them when first landing on a site through design features, such as the use of different colours and levels of contrast;
- situating the options to accept and reject cookies on different layers of a cookie pop-up;
- allowing users to reject cookies only via links to separate webpages, rather than utilising an integrated reject button; and
- making the withdrawal of consent to cookies more difficult than the original giving of that consent.
As can be seen, both regulators and activists have very similar data privacy concerns when it comes to cookies and cookie banners, notably honing in on the need for cookie banners and pop-ups to be designed in such a way that website users are able to make a free and informed choice between consenting to and rejecting cookies.
Throughout this period of increased scrutiny on cookies, Covington’s multi-jurisdictional Data Privacy and Cybersecurity team has been actively assisting clients to navigate the various guidelines and to respond to letters from activists, and is ideally placed to help with any questions you may have.