The Autoriteit Persoonsgegevens (AP) announced via a news release on its website that the use of a so-called "cookie wall" violates the General Data Protection Regulation (AVG). This news release follows the dozens of complaints the AP has received about the use of cookie walls where access to the website is blocked if no permission is given for tracking cookies to be placed.
Co-author: Céline van Waesberge
The main rule for placing cookies is found in the Telecommunications Act (Tw). Pursuant to the Tw, visitors to a website must be informed about the setting and reading of cookies and asked for permission to do so. This rule does not apply to every type of cookie. A distinction is made between cookies that have no or minor consequences for the privacy of the website visitor and other cookies. In this regard, the following three types of cookies are generally distinguished: (i) functional cookies, (ii) analytical cookies and (iii) tracking cookies.
For functional cookies, which are necessary for the website to work properly (such as a cookie that remembers which products are placed in the shopping cart by the visitor), the information and consent requirements do not apply. This exception also applies to analytical cookies used only to obtain information about the quality and effectiveness of the website in question (for example, a cookie used to count website visitors).
For the placement of tracking cookies, however, the information and consent requirements do apply. Tracking cookies allow website visitors to be tracked during visits to other websites and thus the behavior of website visitors can be analyzed. Tracking cookies are used, for example, to show website visitors targeted advertisements. Tracking cookies usually process personal data.
The AVG requires a basis for processing personal data. At first glance, the AVG seems to offer a number of possible bases. For example, the legitimate (commercial) interest of the owner of the website insofar as it concerns a non-invasive invasion of the privacy of the website visitor (this will depend on all relevant circumstances of the specific situation).
The AP thinks otherwise. According to the AP, the only possible basis for the use of tracking cookies is unambiguous consent from the website visitor. As a result, the consent that must be given for setting cookies under the Tw must also meet the requirements of the AVG.
Under the AVG, consent must meet strict requirements. For example, consent must be specific, informed and given through an active act. In addition, consent must be freely given. This means that a website visitor must also be free to refuse that consent without suffering adverse consequences. When using a cookie wall, website visitors have no real or free choice to refuse the tracking cookies. Indeed, refusal to do so results in a visitor being denied access to a website. For this reason, the AP finds the use of a cookie wall on a website to be in violation of the AVG.
The AP instructs organizations to adjust their websites where necessary. In doing so, the AP announces that it will intensify its monitoring of this.
For this reason, organizations recommend the following:
Check what types of cookies are set through your organization's website
If tracking cookies are placed, verify that consent is properly sought for them
Check the cookie banner, cookie statement and how they are available on the website
Make sure that even website visitors who refuse to give their consent to the placement of tracking cookies can still access the website (disable cookie walls)
This article can also be found in the AVG and e-privacy file.
More from Loyens & Loeff
