Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

The Cookie Crumbles: Diverging Approaches to Cookie Consent Requirements

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

Following a relatively quiet period, we are now experiencing a flurry of local regulatory guidance and enforcement, with at least 17 fines being imposed for violations of cookie transparency and consent requirements since December 2020. With this renewed regulatory attention, it is worth taking a closer look at the local requirements and where they currently diverge.<h4>Background and Limited Harmonization</h4>The current EU and UK cookie requirements follow the provisions of the Privacy and Electronic Communications Directive (“ePrivacy Directive”), which dates back to 2003. The ePrivacy Directive had to be implemented into UK and EU Member States’ local laws, which led to a patchwork of slightly different approaches on how to deal with cookies.The purpose of the upcoming <a href="https://digital-strategy.ec.europa.eu/en/policies/eprivacy-regulation" target="_blank">EU ePrivacy Regulation</a> (the “Regulation”) is to update and harmonize the requirements. While we continue to wait for the finalization of the Regulation, we do see some harmonization on an EU level primarily by the Court of Justice for the European Union (CJEU) and the European Data Protection Board (EDPB):<ul><li>The rulings of the CJEU are binding throughout the EU. So when the CJEU clarified the cookie consent requirements in the <a href="https://curia.europa.eu/juris/document/document.jsf;jsessionid=63307BE55F72BCA9701B6A79646E9764?text=&docid=218462&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2219854" target="_blank">Planet49 case</a>, the ruling provided a basis for the requirements in all 27 EU Member States. For more details on the CJEU’s ruling in the Planet49 case, please refer to our <a href="/resources/insights/191023-cookies-age-story.html">client alert</a>.</li><li>The EDPB also contributed to limited harmonization through its guidance and opinions. For example, in its <a href="https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf" target="_blank">Consent Guidelines</a>, the EDPB clarified that the use of cookie walls (i.e., pop-ups that prevent access to websites before cookie consent is given) cannot result in a valid consent. While the EDPB’s opinions are not legally binding, they give a good indication of how the European regulators will decide certain issues if your organization is subjected to a regulatory investigation.</li></ul>In addition, a number of local data protection authorities (DPAs) are either issuing guidance and/or enforcing compliance with the cookie rules. Regulatory enforcement has ramped up recently, with more than 17 fines issued since December 2020, with fines totaling almost 246 million euros. It is interesting to note that this includes very small fines (as low as 374 euros, imposed by a German court) but also very high fines (up to 150 million euros, imposed by the French CNIL). It is also worth noting that all of these fines involve transparency and/or consent infringements.The various decisions and guidance have resulted in a patchwork of rules that may vary according to each applicable EU Member State and make it difficult for multijurisdictional organizations to comply with all of the various requirements.<h4>Diverging Approaches to Cookie Consent Requirements</h4>In order to assess the similarities and differences among the current regulatory approaches to cookie consent requirements, we have reviewed the guidance of the DPAs in the UK, France, Italy, Luxembourg, Germany and the Netherlands. The exercise showed that the regulatory guidance contains many similarities, for example, on the topics of transparency and consent requirements. However, there are also certain key topics on which the DPAs disagree. For example:<ul><li>Consent for analytics cookies: Certain types of analytics cookies may be used without consent in France, Italy and the Netherlands, but in Luxembourg, Germany and the UK, consent is in general required (unless the analytics cookies are strictly necessary for providing a service that is requested by the user, which is rarely the case).</li><li>Consent by scrolling and cookie walls: Consent by scrolling on a web page and the use of cookie walls are – in certain circumstances – allowed in Italy, while they are prohibited in Luxembourg, France, Germany, the Netherlands and the UK.</li><li>Retention periods: The six DPAs agree that cookies cannot have a retention period that exceeds what is necessary for the purpose for which the cookies are used, but the three DPAs that provide a specific period (in France, Luxembourg and the Netherlands) diverge as to whether a period of more than 6, 12 or 13 months will generally be considered excessive.</li></ul>In the chart below, we have summarized the regulatory guidance for the UK, France, Italy, Luxembourg, Germany and the Netherlands on seven key topics of similarity or divergence. Hopefully, the Regulation will be adopted soon, and it will eliminate the differences between the EU Member States. Until that time, however, multinationals using cookies need to consider several sets of requirements. Examples of Diverging Cookie Requirements<table style="width: 0px;" cellpadding="5" cellspacing="0" border="1"><thead><tr><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="109"> Topic</td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">United Kingdom (<a href="https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf" target="_blank">ICO Guidance</a>)</td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">France (<a href="https://www.cnil.fr/sites/default/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf" target="_blank">CNIL Guidance</a>)</td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">Italy (<a href="https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9677876#english" target="_blank">Garante Privacy Guidance</a>)</td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">Luxembourg (<a href="https://cnpd.public.lu/content/dam/cnpd/fr/dossiers-thematiques/cookies/CNPD-LD-Cookies.pdf" target="_blank">CNPD Guidance</a>) </td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">Germany (<a href="https://www.datenschutzkonferenz-online.de/media/oh/20211220_oh_telemedien.pdf" target="_blank">DPC Guidance</a>) </td><td style="width: undefined%; height: auto;background-color: lightgray;" valign="top" width="147">The Netherlands (<a href="https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies" target="_blank">AP Guidance</a>)</td></tr></thead><tbody><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Requirements for valid cookie consent</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard UK GDPR requirements. </td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.In addition, withholding consent must be as easy as giving consent; if consenting takes one click, withholding consent must also be one click.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.In addition, “Accept all Cookies” only constitutes valid consent if certain requirements are met.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Cookie walls</td><td valign="top" colspan="2" width="294" style="width: undefined%; height: auto;">Not allowed.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Allowed if the user can access a similar service without cookie consent.</td><td valign="top" colspan="3" width="441" style="width: undefined%; height: auto;">Not allowed.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Consent by using website</td><td valign="top" colspan="2" width="294" style="width: undefined%; height: auto;">Not allowed.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Scrolling on a web page may constitute valid consent if it is part of a complex process that allows the user to unambiguously indicate their wishes in this manner.</td><td valign="top" colspan="3" width="441" style="width: undefined%; height: auto;">Not allowed.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Essential cookies </td><td valign="top" colspan="6" width="883" style="width: undefined%; height: auto;">Consent is not required for essential cookies. Essential cookies are cookies that are strictly necessary (i) to provide the service requested by the user and/or (ii) for the transmission of a communication over an electronic communications network.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Analytics cookies</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent is required for both first- and third-party analytics cookies.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent is not required for first-party analytics cookies, provided that certain conditions are met.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent is not required for both first- and third-party analytics cookies, provided that certain conditions are met.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent is required for both first- and third-party analytics cookies, and additional requirements apply to the use of analytics cookies that are strictly necessary to provide a service.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent requirements depend on a case-by-case assessment of whether analytics cookies are strictly necessary.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Consent is not required for analytics cookies if they are only used to count visitors.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Transparency obligations</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard UK GDPR requirements.The cookies and their purposes must be clearly stated, along with any third parties that may access the information, and the retention period of the cookies.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.Companies are encouraged to consider whether multilayered notices can be used to provide information that is easy to understand on the medium that is used.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.The use of a two-layered system with a pop-up and a cookie policy is recommended. </td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.Users must be informed about the retention period of cookies and whether and which third parties can access the information.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Standard GDPR requirements.</td></tr><tr><td valign="top" width="109" style="width: undefined%; height: auto;">Retention period</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies’ lifespans must be limited to the duration necessary to achieve their intended purpose.Standard general date settings such as “12/31/9999” are not permissible.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies storage must be limited to the duration necessary to achieve their intended purpose.A retention period of up to 13 months is usually considered to be appropriate.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies storage must be limited to the duration necessary to achieve their intended purpose.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies should only have a retention period of 12 months.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies storage must be limited to the duration necessary to achieve their intended purpose.</td><td valign="top" width="147" style="width: undefined%; height: auto;">Cookies storage must be limited to the duration necessary to achieve their intended purpose.A storage period of more than 6 months is usually considered excessive.</td></tr></tbody></table><h4>What does this mean for our organization?</h4>That is the million-dollar question, and – although depending on the practices of your organization – key actions to consider are:<ul><li>Review your current approach to cookie compliance and determine when it was last updated (e.g., if your organization has started using device fingerprinting after the last update, the cookie compliance program likely needs updating in any case).</li><li>Review your current (and upcoming) projects that involve the use of cookies and similar technologies, and confirm that the use of such technologies is adequate, correct and up-to-date. </li><li>Determine which countries’ ePrivacy rules are applicable to your organization and what the differences are between the relevant countries. </li><li>Determine what approach best suits your organization, considering the current state of affairs in the EU. For example, do you want to have a pan-EU or a country-by-country approach? Is your organization’s risk appetite still the same as it was prior to the recent enforcement actions and the new regulatory guidance? </li><li>Consider whether and how your organization’s documents and processes (e.g., cookie notice, cookie tool, consent banner, cookie guidelines for your business, retention practices) need updating according to the chosen approach.</li><li>Continue monitoring relevant developments in the EU (and in the rest of the world) and considering how they affect your organization’s compliance program. </li><li>Consider how to keep your cookie compliance program up-to-date, and the relevant personnel sufficiently informed and trained on the current and upcoming developments.  </li><li>Start socializing the increased enforcement actions in the EU and the possibility of the upcoming ePrivacy Regulation within your organization. It will likely be worthwhile keeping the relevant stakeholders informed so that they know why additional resources might be needed. It will make them understand the importance of keeping up compliance efforts, and also likely contribute to swift decision making, resulting in fewer surprises for those stakeholders, thus also making your job easier.</li></ul>