The Article 29 Working Party adopted an Opinion on cookie consent exemption during its plenary meeting on 6 and 7 June 2012 in Brussels. The Opinion explains how the revised e-Privacy Directive impacts on the usage of cookies and similar technologies. More specifically, in its Opinion the Article 29 Working Party has analysed the exemptions to the requirement of informed consent in this context. The Opinion discusses cookies that, under certain conditions, can be placed without the requirement of informed consent. It also gives guidelines for deciding whether a cookie is exempt from the principle of informed consent. The Opinion can be read in full here.
The revised Article 5.3 (the so-called ‘cookie-rule’) of the e-Privacy Directive has reinforced the protection of users of electronic communication networks and services by requiring informed consent before information is stored or accessed in the user’s (or subscriber’s) terminal device. The requirement applies to all types of information stored or accessed in the user’s terminal device although the majority of discussion has centred on the usage of cookies.
Article 5.3 allows some cookies to be exempted from the requirement of informed consent, if they satisfy one of the following criteria:
– the cookie is used ‘for the sole purpose of carrying out the transmission of a communication over an electronic communications network’;
– the cookie is ‘strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service’.
In its opinion the Article 29 Working Party has concentrated on these exemptions to this principle of informed consent in the context of cookies and related technologies. The Article 29 Working Party earlier examined the requirements for informed consent in detail in its opinions on Online Behavioural Advertising (WP 171) and on the Easa/IAB Europe Best Practice Recommendation on Online Behavioural Advertising (WP 188).
The analysis in the current Opinion shows that some cookies can be exempted from informed consent under certain conditions if they are not used for additional purposes. These cookies include ‘user-input’ cookies (used to keep track of the user’s input when filling online forms or as a shopping cart), also known as session-id cookies, multimedia player session cookies and user interface customization cookies (for example language preference cookies to remember the language selected by a user).
First party analytics cookies are not likely to create a privacy risk when they are strictly limited to first party aggregated statistical purposes and when they are used by web sites that already provide clear information about these cookies in their privacy policy as well as adequate privacy safeguards. Such safeguards are expected to include a user-friendly mechanism to opt-out from any data collection and comprehensive anonymization mechanisms that are applied to other collected identifiable information such as IP addresses.
The Article 29 Working Party would like to stress that, in order to decide if a cookie is exempted from the principle of informed consent, it is important to verify carefully if it fulfils one of the two exemption criteria defined in Article 5.3 the e-Privacy Directive. In case of doubt web site operators can of course always ask the user’s consent, thus avoiding any legal uncertainty.
