11 November 2013

Working Party 29 issues guidance on EU-wide cookie consent

The Article 29 Working Party has published a working document  providing guidance on obtaining consent for the use of cookies in a harmonised manner in light of the different implementations of the cookie rules across the EU. This working document includes concrete recommendations on a valid cookie consent mechanism.

This information is available in English only.

The Article 29 Working Party (“Working Party 29“) published a working document  ( “Working Document“) on 14 October 2013 providing guidance on obtaining consent for the use of cookies in a harmonised manner in light of the different implementations of the cookie rules across the EU.

Article 5.3 of the revised e-Privacy Directive 2002/58/EC (implemented in article 11.7a of the Dutch Telecommunications Act) requires website operators to obtain consent from users for the storage of, or access to, non-functional cookies and other similar technologies on their devices. In the Working Document, the Working Party 29 gives guidance on how to obtain consent from users in a uniform manner in light of the different implementations of the cookies rules across the EU. The guidance of the Working Party 29 is based on the main elements of consent as described in its Opinion  on consent of 13 July 2011. According to the Working Document, a cookie consent mechanism should include each of the following elements:

  • specific information
  • timing
  • active choice
  • freely given 

Specific information
When consent is needed users should be presented with a clear, comprehensive and visible notice informing them of the use of cookies. The notice must include information on the different types and purposes of (third-party) cookies being used and other relevant information such as cookie expiry dates and typical values. Also, users must be informed of how to accept all, some or no cookies and on how to change their preferences in the future.

Timing
The Working Party 29 notes that consent has to be obtained prior to the storage of, or access to, cookies. This requires a cookie consent mechanism to be implemented ensuring that no non-functional cookies may be stored or accessed on users’ devices before obtaining consent.

Active choice
The threshold set by the Working Party 29 for obtaining consent is a positive action or other active behaviour of users, provided that users have been presented with clear and comprehensive information on how they may signify their consent. The Working Party 29 gives examples of how consent may be obtained:

  • by clicking on a button or link
  • by ticking a box in or close to the space where information is presented
  • by any other active behaviour from which a website operator can unambiguously conclude specific and informed consent. 

The Working Party 29’s position is that consent via browser settings may only be valid

in very limited circumstances: if the website operator can be confident that the user has been fully informed and has actively configured their browser or other application then, in the right circumstances, such a configuration could signify an active behaviour.

The Working Party 29 also posits that:

  • the information should be present on the website and not disappear until users have expressed their consent
  • only a click on a “more information on cookies” link cannot be deemed consent
  • absence of any behaviour cannot be regarded as valid consent. 

Freely given
The Working Party 29 appears to interpret the requirement that consent must be freely given more strictly than it had done previously. The Working Party 29’s position is that access to a website conditioned on the acceptance of cookies (a “cookie wall”) is not permitted. Users must be presented with a real choice and should have the opportunity to freely and granularly choose between which cookies to accept and to change their preferences at any time. Tracking cookies are specifically mentioned as cookies of which users should be offered a granular choice.

The Working Document facilitates operators of websites and other applications in obtaining – in a uniform manner within the entire EU – the required consent of end-users for the use of cookies.