IRISH DPC IN COOKIE SWEEP
Irish website owners and operators have been warned by the Irish Data Protection Commission (DPC) that they could face enforcement actions over the use of tracking cookies.
Following an examination of the use of cookies and similar tracking technologies on a selection of websites across a range of sectors, the DPC reports that “third parties are tracking users of Irish websites to a significant degree across their browsing habits and daily online activities”.
While only a small number of websites (38) were targeted in the sweep, the results indicate a total lack of even basic information regarding privacy and the inability of users to give unambiguous consent for the placement of tracking technologies or cookies on their devices.
The DPC states that “most ordinary users will not be aware of the extent to which they may be tracked across their devices at home and at work, and across their browsing, reading and social habits”.
Although users are rarely tracked by name, the ability to track them by unique identifiers set through cookies means users are being targeted as individuals. Such targeting/profiling is subject to the GDPR and requires valid consent from the users of the website.
SIX-MONTH GRACE PERIOD BEFORE ENFORCEMENT
The fact that bad practices are widespread even among companies and websites that are household names suggests a more systemic issue that must be tackled.
Therefore, the DPC has published a new guideline for data controllers for the use of cookies and other tracking technologies.
The new guidance will be followed by possible enforcements where controllers fail to bring themselves into compliance voluntarily.
The DPC sets the grace period to six months for websites to get compliant.
HOW TO OBTAIN VALID CONSENT TO COOKIES?
If you are looking to bring your website into compliance with the DPC’s requirements for cookies and consent, we provide you with a short overview of obtaining valid consent.
Obtaining valid consent requires:
To collect valid consent, you need a cookie consent solution (banner) which:
- Informs your visitors of cookies (who owns them; their purpose; lifespan)
- Provides your visitors with the option to decline cookies (and tracking)
- Holds back cookies before consent is obtained
- Does not assume consent with pre-ticked boxes
- Collects and stores consents for 5 years (in case of inspection by DPA).
