Websites that give visitors access only if they agree to the placement of tracking cookies do not comply with the General Data Protection Regulation (AVG), the Personal Data Authority believes. Many websites use a so-called cookie wall: a pop-up asks for permission to place and read cookies, but if permission is not given, the visitor cannot visit the site.
This standard explanation not only has a major impact on the revenue models of many websites; the restrictive interpretation of the "free expression of will" criterion by the Personal Data Authority deviates from the position envisioned by the legislature when the cookie rules were created.
The definition of "consent" in the AVG requires that there must be a free expression of will. In other words, the Internet user must have freedom of choice. The Personal Data Authority takes the position that in the case of cookie walls on websites, consent is not freely given because website visitors cannot access the website without giving consent. The website visitor then apparently does not have a free choice, according to the Personal Data Authority.
This discussion about cookie walls and (free) consent is not new. When the cookie rules were changed in 2014, this topic was extensively discussed. At the time, the legislator took the position that a general ban on cookie walls for commercial websites was undesirable and that cookie walls did not violate the requirement that consent be free:
"Not being able to use the website that the visitor requests, or only for a fee, is not in itself sufficient to assume that the visitor cannot make a free choice whether or not to consent to the use of cookies. Therefore, a cookie wall is generally a lawful way to satisfy the consent requirement in the cookie provision."
Of course, there are also situations where the website visitor's freedom of choice is undermined:
"This is the case in any case if the visitor is so dependent on the services and information offered via a particular website that the use of the cookie wall can no longer constitute a free expression of will, for example, if the failure to give consent is associated with the consequence that the Internet user is unable to exercise a legal right (for example, number portability when changing to another telephone provider), cannot comply with a legal duty (for example, tax returns), or receives inferior medical care."
But whether this is the case must be judged by the circumstances of the specific case. This will usually involve websites of a monopoly holder or of the government, on which a service or information is provided that the internet user cannot get anywhere else. A blanket ban on cookie walls in advance, without assessing the concrete circumstances, as the Personal Data Authority does, therefore goes too far. In most cases, a cookie wall does offer a degree of freedom of choice that results in freely given consent. After all, the website visitor retains complete control over the situation. Websites typically place cookies only after the visitor has given the conscious and informed consent to place cookies. In addition, the website visitor can refuse consent by leaving the website and choosing one of the many alternatives. Incidentally, this opinion is also held by the Austrian privacy regulator.
Most Web sites can be accessed without payment. In many cases, this is only possible because the website is funded by advertising revenue. In 2015, the government took the position that if a website visitor is not willing to pay the website's "price" of allowing tracking cookies, the website provider should in principle be free to refuse further access. The government explicitly did not want to interfere with the entrepreneurial freedom regarding the website provider's ability to demand consideration for the use of its website.
The economic value of the European online advertising market is estimated at €23.5 billion by 2020. Of that, more than 21.4 billion will come from personalized ads. If far fewer ads could be shown, companies would lose some 35 percent in ad revenue, according to a German study. This is especially true for media companies that offer their content for free and get their revenue mainly from targeted ads. The impact on the Dutch media landscape is therefore expected to be significant.
In response to the legislature's position, the Personal Data Authority (then known as the Data Protection Authority) announced then, as again now, that the use of a cookie wall was not in compliance with privacy laws. But the legislature even then explicitly let it be known that it did not agree:
"In the context of the consent requirement, the CBP addresses making access to the website conditional on giving consent to the setting/reading of cookie (the cookie wall). The CBP points to the last sentence of Recital 25 of the e-Privacy Directive: "Access to specific content of a website may still be subject to the condition that a cookie or similar device, if used for a legitimate purpose, is knowingly accepted." From this, the CBP seems to infer, a contrario, that making access to the entire website conditional on consent to the use of cookies is not permitted. However, the government does not share this reading."
The Dutch Cookie Law, which is based on the European ePrivacy Directive, does ban cookie walls, but it only applies to government websites. Because these websites are publicly funded and thus already paid for, website visitors cannot be forced to pay for access to them again with their privacy. No such prohibition for commercial websites follows from the law.
The successor to the ePrivacy Directive, the ePrivacy Regulation, now under discussion at the European Council, is also not expected to include a blanket ban on the use of cookie walls.
The Personal Data Authority's standards explanation means that an ad-based revenue model is hardly possible anymore. For news websites that primarily offer their content for free, and thus need to generate advertising revenue to recoup investments in journalism, this will likely mean that offerings will disappear behind pay walls. Free media services will then disappear from the online landscape.
Therefore, it is highly questionable whether the Personal Data Authority's position will stand, given the legislative history and the new ePrivacy Regulation, which is likely to take effect this year.
This article can also be found in the files AVG and e-Privacy
More articles by SOLV Lawyers
