4 ms·
> The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shoppi
by tcldr 5y ago
> The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc.
I think this area has always been a bit murky, actually. There's currently a review of the ePD taking place to unify it with the GDPR and clarify on points such as these. This is in the working group's memo from March 2021
> Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users
> The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals.
> Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection.
Source: https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0...
This seems a reasoned approach.