By Dan Cooper and Mark Young

This week, the Article 29 Working Party (the “WP29”) released an opinion paper on what constitutes “consent” for purposes of complying with the EU’s “cookie” rules — rules that were revised to include a consent requirement nearly four years ago.  The paper will be relevant to website providers that are subject to the EU’s cookie regime.

The timing of the paper is curious.  After EU Directive 2009/136, amending Directive 2002/58, was passed in 2009, the market was in a state of limbo as Member States worked out what the consent rules meant and how to implement them in national law (see here).  To everyone’s relief, a consensus slowly began to emerge, arguably spurred by guidance from the UK Information Commissioner’s Office (the “ICO”) in late 2011 and May 2012 (see here and here).  Now, the latest WP29 guidance — which is not legally binding but carries significant weight — threatens to revive the old debate and compel industry to revisit issues that many thought were resolved.

For example, the paper suggests that going forward websites “operating across all EU member states” — although it is not clear what this actually means — will need to adopt the following mechanisms to ensure that user consent is valid:

• Specific information.  In addition to other relevant disclosures, operators will have to inform users about how to accept all, some or no cookies, and how they can change their preferences in the future.
• Prior consent.  Website operators will be expected to obtain consent from users before deploying non-essential cookies, such as analytics or behavioral advertising cookies, on the user’s device.
• Affirmative action.  Even more controversially, websites will have to capture affirmative user consent through the clicking of a button or a link, or the ticking of a box positioned near the relevant cookie notice (as opposed to passive pop-ups or banners, commonly used by industry at present).  The WP29 also points out that information on cookies should remain visible on the site until the user has expressed his or her consent; which again runs contrary to current practices.
• Real choice.  Users should be given a real choice about the types of cookies deployed on their machine, which in practice would mean being allowed to access a website without accepting non-essential cookies.  Such granularity is only a recommendation and it remains to be seen how, and if, it will be adopted by websites.

Continue Reading European Regulators and the Eternal Cookie Debate