Cookie law breaches

[nw1]

Have encountered, from time to time, what look, to me, like potential breaches of cookie law.

My understanding of cookie law is that there must be an option to turn off non-essential uses of cookies (essential cookies being, basically, only the use of cookies for maintaining a user session, such as preserving the user's login from page to page, or maintaining a shopping cart - so everything else is non-essential).

Have just gone to one site (who shall remain nameless) and find that certain classes of non-essential cookie are always active. I've seen this on other sites before, including organisations where I wouldn't expect it.

- Technically deliver ads or content
- Match and combine offline data sources
- Link different devices
- Receive and use automatically-sent device characteristics for information

Some of these sound a bit suspect to me and potentially privacy violating - would such a company, in the UK or EU, be in violation of cookie law?

 

[najaB]

Some of these sound a bit suspect to me and potentially privacy violating - would such a company, in the UK or EU, be in violation of cookie law?

In a word, unlikely. As long as they provide a link to their privacy policy on first visit and the policy spells out what cookies they do/don't use then they have complied with the
Lawfulness, fairness and transparency principle.

While most sites choose to give visitors the option to disable certain cookies there is no specific requirement to do so.

 

[nw1]

@najaB ok thanks for that, I was convinced that non-essential cookies had to have an "opt out" button.

 

[najaB]

@najaB ok thanks for that, I was convinced that non-essential cookies had to have an "opt out" button.

They don't have to have an opt-out button, but it is a good idea to do so as anyone who is concerned about tracking cookies will just go somewhere else that does provide one.

 

[WelshBluebird]

@najaB ok thanks for that, I was convinced that non-essential cookies had to have an "opt out" button.

Essentially, the "opt out" can be telling the user to not use the site. As anti consumer / visitor as that may sound, it is an entirely reasonable business outcome for some businesses and perfectly legal. Somewhat similar to the US based sites that as a response to GDPR, simple blocked European users from their sites (of course companies that tried that missed the fact GDPR applies to EU Citizens in the US too).

 

[Strat-tastic]

As I've argued from the beginning, this needs to be set at a browser level. Job done once and for all (specific site exceptions of course).
No more setting preferences (or not, as in here) every time you visit a new site.
User friendly!

 

[DynamicSpirit]

@najaB ok thanks for that, I was convinced that non-essential cookies had to have an "opt out" button.

I imagine such a law would be almost impossible to frame, even if it was decided we wanted one - since there's not really any hard definition of what 'essential' means in the context of having a website work.

== Doublepost prevention - post automatically merged: 31 Oct 2022 ==

As I've argued from the beginning, this needs to be set at a browser level. Job done once and for all (specific site exceptions of course).

I can't really see how that could technically be achieved, since there's no general way for a browser to know what the purpose of any particular cookie is, and therefore whether it should or should not be accepted. You can disable 3rd party cookies - and I think pretty much every browser does offer that as a (default?) option already, but that doesn't cover non-3rd-party marketing/etc. cookies.

 

[Cloud Strife]

As long as they provide a link to their privacy policy on first visit and the policy spells out what cookies they do/don't use then they have complied with the
Lawfulness, fairness and transparency principle.

Are you sure about this? I know that there are already cases in some EU countres where companies have been fined for installing cookies without consent:

https://codozasady.pl/en/p/fines-for-installing-cookies-without-the-users-consent

In the second case, AEPD fined an airline EUR 30,000 for not allowing end users to refuse to consent to installation of cookies, and thus, as it were, forcing them to use cookies every time they viewed the site. The airline’s website could not be viewed without accepting cookies. The regulator held that this violated Art. 5 and 6 GDPR, again due to the lack of a legal basis for processing the personal data of the website’s users.

My understanding is that it's not enough to simply provide a link to the privacy policy, but that you specifically need to provide a way to opt-out of all but essential cookies.

 

[nw1]

I imagine such a law would be almost impossible to frame, even if it was decided we wanted one - since there's not really any hard definition of what 'essential' means in the context of having a website work.

I would consider the session cookie (the cookie that maintains the user's session, and distinguishes that user from other users; it is necessary for a login system, for example) as the only truly essential cookie. Most other things (e.g. language preferences) can be stored on the server and linked to that user's account.

 

[dosxuk]

I would consider the session cookie (the cookie that maintains the user's session, and distinguishes that user from other users; it is necessary for a login system, for example) as the only truly essential cookie. Most other things (e.g. language preferences) can be stored on the server and linked to that user's account.

A session cookie is one that only exists for the duration of a user's session and is then removed - either after a time of not accessing a site or when the browser is closed. As these are not persistent they can't be used to store information about someone and therefore don't fall under GDPR.

Common use is for session id's for maintaining sessions at the server end, but there's all sorts of things that are useful to have at the client end. Simple shopping carts are one of the other examples the guidance uses.

The real world analogue to these types of cookie are the salesman remembering your name while talking to you when negotiating a transaction - the information is never stored anywhere, so no GDPR rules apply. Once you start filling in the paperwork and commit your name to paper, GDPR kicks in.

 

[najaB]

Are you sure about this? I know that there are already cases in some EU countres where companies have been fined for installing cookies without consent

Yes. All that is strictly required is a prominent notice to the effect "This site uses cookies. Continued use of the site implies acceptance of our privacy policy which can be found here".

However, implied consent of that nature is considered to be weak and poor form, the suggestion is that sites use a mechanism that requires positive consent, since what's 'prominent' to me isn't necessarily prominent to you - hence why the tendency now is to use modal pop-ups and an opt-in/-out dialog.

 

[nw1]

A session cookie is one that only exists for the duration of a user's session and is then removed - either after a time of not accessing a site or when the browser is closed.

Yes, I am aware of that - sorry if it sounded like I didn't.

As these are not persistent they can't be used to store information about someone and therefore don't fall under GDPR.

Yes, I thought that was the case, hence they do not have the option to turn them off (unlike others, on a well-behaved site).

Common use is for session id's for maintaining sessions at the server end, but there's all sorts of things that are useful to have at the client end. Simple shopping carts are one of the other examples the guidance uses.

Perhaps yes, though in these sorts of examples I would tend to favour the server due to the privacy concerns around cookies (even if, as in this case, they are being used harmlessly).

 

[najaB]

Perhaps yes, though in these sorts of examples I would tend to favour the server due to the privacy concerns around cookies (even if, as in this case, they are being used harmlessly).

Storing the data on the server is more of a data protection issue than using a cookie.

 

[nw1]

Storing the data on the server is more of a data protection issue than using a cookie.

I agree completely for confidential information/personal data (which really shouldn't be stored at all unless it's absolutely necessary), but from my understanding the server is the more common place to store something like a shopping cart.

 

[najaB]

I agree completely for confidential information/personal data (which really shouldn't be stored at all unless it's absolutely necessary), but from my understanding the server is the more common place to store something like a shopping cart.

It depends. Using cookies is infinitely more scalable since the server doesn't have to store state at all and you can load balance across multiple servers a lot easier. It does have the downside that the shopping cart doesn't follow you between devices.