4 ms·

What most websites don't realise is that cookies aren't only covered by GDPR, but also the ePrivacy directive (or more specifically its national implementation,

by g_p 5y ago

What most websites don't realise is that cookies aren't only covered by GDPR, but also the ePrivacy directive (or more specifically its national implementation, since it is a directive). The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. The combination of GDPR and ePD means that your ePD cookie consent must meet GDPR standard levels of consent, which require clear, unambiguous opt-in, informed consent. And that rules out many dark patterns we see everywhere. The German "Planet 49" ruling confirms that consent is required for cookies. Therefore every time I see "legitimate interest" on a cookie banner, I know it's an ill-informed attempt at a dark pattern by someone who wants a second bite at the cherry, and doesn't understand they: 1. Require consent 2. Need this consent to be actively given (opt in, not opt out). 3. Can't just ask the question again with a pre-ticked box and hide it behind a tab or fold...

tcldr 5y ago
> The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. I think this area has always been a bit murky, actually. There's currently a review of the ePD taking place to unify it with the GDPR and clarify on points such as these. This is in the working group's memo from March 2021 > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. Source: https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0... This seems a reasoned approach.

by g_p 5y ago

tcldr 5y ago

> The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. I think this area has always been a bit murky, actually. There's currently a review of the ePD taking place to unify it with the GDPR and clarify on points such as these. This is in the working group's memo from March 2021 > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. Source: https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0... This seems a reasoned approach.