10 October 2013

Cookies with no or low privacy risk may also be exempted from consent requirement

A recently proposed amendment aims to exempt cookies with no or low privacy risks from the consent requirement. Analytics cookies, as well as affiliate and a/b testing cookies may be exempted. Websites using these types of cookies will not have to ask users for prior informed consent if the proposed amendment is enacted.

Since the new cookies rules have gone into effect, there has been some objection to the types of cookies that require the prior informed consent from website users.

To address these objections, the Dutch Minister of Economic Affairs had previously indicated that analytics cookies may be exempted from the consent requirement. Analytics cookies are often only placed to measure the website’s use and generally have little to no impact on the user’s privacy. At the time, the Minister indicated that this exemption only related to first-party cookies (that is, cookies placed by the website owner). In a proposed amendment, the Minister has now indicated that, in principle, all types of analytics cookies can be exempted (both those placed by the website owner: first-party cookies, as well as those placed by third parties: third-party cookies). The proposed amendment is “technology neutral”, meaning that the exemption relates to cookies with little to no impact on the user’s privacy. In addition to analytics cookies (which analyse and improve websites), the Minister mentioned that affiliate cookies (which analyse the effectiveness of advertisements) and a/b testing cookies (which compare the effectiveness of multiple types of advertisements) may also fall under this exemption.

The Minister also indicated that where cookies do require consent, there should be a possibility to provide consent implicitly. This requires a clear action from the user which infers consent. Implied consent cannot be construed by an omission to act.