Keywords: Article 29, Data Protection, Cookie Consent Mechanisms, Europe

The Article 29 Data Protection Working Party (the "Working Party") recently issued guidance which sets out the minimum standards required to obtain consent for cookies throughout Europe. The body, which represents all data protection authorities throughout the European Union, has published this guidance on cookie compliance which, amongst other suggestions, highlights the importance of allowing website users to exercise free choice when accepting cookies, the need to obtain active consent and the requirement for not setting cookie consent mechanisms on an entry page before active usage has occurred.

In its opinion, the Working party has said that:

  • The website operator must provide precise information which properly states the accurate purpose of the processing. The operator must receive consent before setting the cookies and this consent must be unequivocal. This means that the procedure to seek and give consent must leave no doubt as to the data subject's objective. Valid consent must be an active sign of the user's wishes and needs to be freely given with the data subject exercising a real choice;
  • The consent mechanism for cookies should provide a clear, comprehensive and visible notice on the use of the cookies, at the time and place where the consent is sought e.g. on the entry page. When they access the website, users should be able to access all necessary information about the different types or purposes of cookies being used by the website;
  • Consent must be given before the data processing begins. To achieve compliance between all Member States consent should be sought before cookies are set or read;
  • The website must provide clear information to the users on how they may indicate their consent, most likely on the entry page. Tools to obtain consent may include splash screens, banners, modal dialog boxes and browser settings. The process by which users could signify their consent for cookies would be through a positive action or other active behaviour e.g. by ticking a box or clicking on a link; and
  • The cookie mechanism must provide the user with a real choice regarding cookies on the entry page. They must freely choose between the option to accept all/some cookies or decline all/some cookies. They must maintain the ability to change the cookie settings if they so wish. The opinion from the Working Party also notes that users need a real choice with regards to tracking cookies as they believe that these tracking cookies collect personal data and thus need full permission from the user.

This opinion demonstrate the requirements (such as timing, real choice and active choice) when dealing with the matter of EU cookie compliance. As this guidance sets out the minimum standards with which to operate cookies in the EU, this is an issue that should be taken seriously and swift action should be taken to act accordingly.

To view the full Working Party document click here.

Previously published on 30 October 2013

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© Copyright 2013. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.