The European Data Protection Board (EDPB) has tightened the guidelines of Europe's cookie regulations. The new version states that websites are not allowed to block their content with a so-called cookie wall. That does not give users the freedom to make an informed choice. So writes the umbrella organization of all national privacy regulators in the EU in the tightened guidelines.
It has been several years since the European Commission imposed new guidelines regarding the use of cookies. Since 2018, the ePrivacy Directive has been in place. In a nutshell, this directive says that website owners must clearly inform visitors in advance about what cookies it places on visitors' computers before they read the site's content. These include marketing cookies, analytical cookies, functional cookies, tracking cookies, flash cookies and third-party cookies.
Website owners are not required to have prior permission from visitors for all of the above cookies. The ePrivacy Directive states that cookies that have little or no invasion of our privacy do not require explicit consent from visitors. These include analytical, functional and security cookies, for example. This does not apply to tracking and third-party cookies, among others. These cookies are used to map users' browsing behavior and present targeted advertisements.
When you visit a website, a pop-up window appears on the screen. In it, Web site owners mention that their site uses cookies, with or without a list of exactly which cookies and for what purposes they are used. In the disclaimer or privacy statement of sites, which they are required to include, visitors can read all the details about this. Based on that, they can decide whether or not to agree to them.
What is not allowed, according to the EDPB, is creating a blockade that visitors must agree to before they can access the Web site. All content is then inaccessible and can only be read if they agree in advance to the placement of cookies. This is also known as a cookie wall or cookie wall. The latest edition of the European data protection supervisor's guidelines explicitly states. "In order to freely give consent [to the storage of cookies, ed.], access to services and functionalities should not be a condition for users to store information, or to access information already stored," the EDPB said.
Thus, a website owner may not place a script on his site that makes content inaccessible to users and require them to agree to his cookie policy in advance in order to gain access. The EDPB ruled that this is not free choice because visitors are not presented with a choice. In fact, all they can do is accept the cookies.
The tightening of the directive echoes what the Autoriteit Persoonsgegevens (AP) said on the issue last year. The privacy regulator said website owners are not allowed to block content with a cookie wall. "Under the General Data Protection Regulation (AVG), a cookie wall (cookie wall) is not allowed. This is because with a cookie wall you cannot get valid consent from your visitors or users for setting tracking cookie. With a cookie wall, website visitors have no real or free choice. True, they can refuse tracking cookies, but not without adverse consequences. Because refusing tracking cookies means they will not be able to access the website. That is why cookie walls are prohibited under the AVG," the AP said at the time.
State Secretary of Economic Affairs Mona Keijzer was still forced to acknowledge in November 2019 that the ePrivacy Regulation did not expressly prohibit cookie walls. An explicit ban on cookie walls did not have the support of enough member states at the time, she wrote in a Parliamentary letter on the Telecom Council.
View: Guidelines 05/2020 on consent under Regulation 2016/679 (Version 1.0; 04-05-2020)
This news item can also be found in the ePrivacy dossier
