Websites use tracking cookies without valid permission
The Dutch Data Protection Authority (AP) has investigated 175 websites pertaining to webshops, public administrations, and national media to determine whether they meet the requirements for placing tracking cookies.
Almost 50% of the websites that use tracking cookies do not meet the requirements of the GDPR. Practically all webshops in the investigation do not comply with basic GDPR requirements regarding cookies.
The owners of these websites have received a letter from the AP calling on them to adjust their tracking methods to comply with European law.
In the near future, the Dutch Data Protection Authority will follow up on the investigation to establish whether the websites’ use of cookies has become compliant.
Pre-ticked checkboxes are not allowed
Tracking cookies collect and process data about visitors’ internet behavior. With this data, website owners get insights into their visitors’ personal preferences and behavior.
This knowledge can be used to target the visitors with personalized advertisements.
Because of the personal data processing, the website must – according to the GDPR – ask visitors for permission to place tracking cookies on their computers and smart phones.
However, as we have seen in the recent ruling by the European Court of Justice, consent must be informed and actively given – not based on the website’s assumption that the visitor wants cookies.
A checkbox with cookies pre-selected in the cookie banner is not allowed (see ruling).
And consent must be actively given. “If you continue using the website, you agree to cookies” is no longer allowed and is therefore not considered valid consent.
European Court of Justice ruling – Planet49
On October 1, 2019, the European Court of Justice ruled that the website must obtain valid consent to set cookies. Silence, inactivity, scrolling down, or pre-selected checkboxes are not considered valid consent.
Are you unsure whether your website or webshop follows the requirements of the GDPR and the recent EU Court ruling on cookies and consent?
Test your website today. It’s easy, it’s free, and we will provide you with a professional and thorough assessment of your GDPR cookie compliance.
Cookie walls not allowed, says Dutch Data Protection Authority
A number of websites with cookie walls were also found during the inspection. Earlier this year, the Dutch Data Protection Authority published
standards
explaining
cookie walls are not permitted
under the General Data Protection Regulation (GDPR)
With a cookie wall (cookie wall), websites, apps, or other services use the ‘data of access’ method in which users are forced to give consent for using the service.
The AP determines that the websites found in the inquiry using cookie walls also receive a letter stating that cookie walls are not allowed as the consent is not valid regarding the GDPR.
How to use tracking cookies without getting in trouble ?
The easiest way is to ask permission to use tracking cookies in the cookie banner. Most visitors accept anyway (our reports say 98,5%).
Here’s a checklist to see whether your cookie consent solution and cookie banner comply with the GDPR.
Checklist to comply with the GDPR for cookies
- Does your website have a cookie pop-up banner?
- Does your pop-up collect and store valid consent?
- Can your visitors decline cookies (opt-out)?
- Does your cookie solution hold back cookies until you have received consent (prior consent)?
- Is there a description of all cookies, purpose, and lifetime?
- Does your website have a comprehensive list of all third-party data processors who receive data about your visitors?
Learn more about cookies, GDPR, and requirements here:
