The Personal Data Authority (AP) this week sent a letter to 50 organizations demanding that they modify their misleading cookie banner or stop intrusively tracking their visitors. If they do not do so within 3 months, the AP will launch an investigation into those organizations and they run a high risk of a fine.
These are the first 50 of a total of 500 organizations the AP plans to warn each year that their cookie banners are out of order. The AP constantly monitors 10,000 Dutch websites and selects from them organizations that are likely to violate the law with their cookie banners. The first 50 letters went to Web stores, media companies and insurers, among others. Each letter contains a warning and an explanation of how it should be done.
AP chairman Aleid Wolfsen: 'With tracking cookies and other tracking software that websites use, they collect large amounts of data on their visitors. As if someone follows you through the shopping street and writes down what you buy, follows you home, peeks through the windows and makes a note of who you are married to and what your children's names are. This sounds strange, but online this happens all the time, without organizations asking permission in a decent way. With this action we force hundreds of organizations to stop this in one fell swoop.
In the letter, the AP points out exactly what is misleading about that organization's cookie banner. For example, that the website already places cookies before the visitor has given permission. Or that in the cookie banner the permission for tracking cookies is already checked. Or that visitors only reach the 'decline' button when they click through to a subsequent window.
The AP also educates organizations with the rules of thumb for clear cookie banners on the AP's website. And by inviting the organizations to an information session on clear cookie banners at the AP's office.
'We don't just point out to organizations what they're doing wrong,' Wolfsen said. 'We also help them do it right. As far as we are concerned, the first question organizations should ask themselves is: Is this actually normal? Is this how I want to make my money? Do I use this data at all? Do I actually want to track my visitors so intrusively? If not, the solution is very simple: stop it. Then you're done immediately. Then you don't need a cookie banner on your website. An investigation by the AP will be off the table. And your visitors will thank you.
