Introduction
In today’s digital world, methods and technologies for collecting and processing personal data (e.g. cookies) are extremely widespread because they allow data controllers to learn essential information about us. For example, after a single search for a shoe on the Internet, we are almost inevitably confronted with advertisements for the same or similar shoes on other platforms.
The relationship between data controllers and individuals is fundamentally unequal, as average users are typically unaware of the many ways in which their personal data are handled. To balance this, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (“ePrivacy Directive“) and Regulation 2016/679/EU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR“) were adopted to ensure privacy and the protection of personal data. These EU laws set out minimum requirements for data controllers to compensate for asymmetric relationships.
NGOs such as None of Your Business (“NOYB“) are helping to ensure that these rights are effectively enforced. As a result of NOYB’s work the European Data Protection Board’s Cookie Banner Taskforce has published its newest report. In this, the Taskforce has identified 7 main cookie management practices which it considers to be inadequate in the light of the relevant legislation. These are briefly summarized below in order to help website operators to adapt their practices and users to be more aware of them:
No reject button on the first layer: It does not meet the requirements for consent if the information window on cookies that require consent only offers the option “accept” or “more information”, but without containing a button to reject the cookies.
Pre-ticked boxes: Indeed inadequate to pre-tick the boxes from the available options that the data controller prefers when setting cookies.
Use of a link: The accept button for cookie-related data management typically pops up automatically on all pages, but some data controllers provide the rejection option only through a separate link, making it difficult for users to make a voluntary choice and putting pressure on them.
Deceptive button colours and contrast: For valid consent it is also an important factor how the possibilities are visually represented. Indeed, if the colour or contrast of the buttons displayed is misleading for the data subject (e.g. if, in addition to the clear display of the accept button, the contrast between the colours of the reject and additional options button is so minimal that the text is almost unreadable), the consent given will most likely be considered invalid. Of course, this should always be considered on a case-by-case basis.
Misrepresentation of the legal basis: It is not lawful for the site operator to base data processing first on the consent of the visitor or, in the absence of consent, on legitimate interest. In this respect, it is particularly unlawful where the user has no possibility to object to the consent, given that in the absence of consent, the controller will process the data on the basis of his legitimate interest, as this may give the impression that the data subject can only consent to the processing and has no other choice.
Inaccurately classified “essential” cookies: The Taskforce has highlighted in its report, that many data controllers classify cookies as essential or strictly necessary, that in fact shall not be considered as essential.
No withdraw icon: A further requirement for consent is that it should be revocable at any time, in the same simple way as it was given by the data subject. Thus, data controllers should also provide for this possibility in relation to cookies (e.g. by placing a floating revocation button or link).
Summary
As can be seen from the above, data controllers must act in such a way as to ensure that users have access to the right information and are thus put in a position to make decisions. Of course, it is the responsibility of the data subjects to actually inform themselves and thus act and make decisions as informed users with regard to their own data (e.g. by customizing their preferences, leaving the visited pages after use, reading the NAIH’s information notices, the controller’s privacy policy).
