This information is available in English only.
Article 5.3 of the revised e-Privacy Directive 2002/58/EC (implemented in article 11.7a of the Dutch Telecommunications Act) requires website operators to obtain consent from users for the storage of, or access to, non-functional cookies and other similar technologies on their devices. In the Working Document, the Working Party 29 gives guidance on how to obtain consent from users in a uniform manner in light of the different implementations of the cookies rules across the EU. The guidance of the Working Party 29 is based on the main elements of consent as described in its Opinion on consent of 13 July 2011. According to the Working Document, a cookie consent mechanism should include each of the following elements:
- specific information
- active choice
- freely given
The Working Party 29 notes that consent has to be obtained prior to the storage of, or access to, cookies. This requires a cookie consent mechanism to be implemented ensuring that no non-functional cookies may be stored or accessed on users’ devices before obtaining consent.
The threshold set by the Working Party 29 for obtaining consent is a positive action or other active behaviour of users, provided that users have been presented with clear and comprehensive information on how they may signify their consent. The Working Party 29 gives examples of how consent may be obtained:
- by clicking on a button or link
- by ticking a box in or close to the space where information is presented
- by any other active behaviour from which a website operator can unambiguously conclude specific and informed consent.
The Working Party 29’s position is that consent via browser settings may only be valid
in very limited circumstances: if the website operator can be confident that the user has been fully informed and has actively configured their browser or other application then, in the right circumstances, such a configuration could signify an active behaviour.
The Working Party 29 also posits that:
- the information should be present on the website and not disappear until users have expressed their consent
- only a click on a “more information on cookies” link cannot be deemed consent
- absence of any behaviour cannot be regarded as valid consent.
The Working Party 29 appears to interpret the requirement that consent must be freely given more strictly than it had done previously. The Working Party 29’s position is that access to a website conditioned on the acceptance of cookies (a “cookie wall”) is not permitted. Users must be presented with a real choice and should have the opportunity to freely and granularly choose between which cookies to accept and to change their preferences at any time. Tracking cookies are specifically mentioned as cookies of which users should be offered a granular choice.