by Judit Szalatkay
The European Data Privacy Board (EDPB) established a taskforce to set an overview on practices of existing cookie banners. The taskforce published its report[1] in the beginning of the year 2023 in which it identified several deceptive and manipulative tactics that occurred int the examined webpages. Parallel, the European Commission’s justice and consumer protection department started to work on the way-out from the maze of the wide range of and partly incorrect cookie banners. As a result, it announced the draft “Cookie pledge principles” after discussions with businesses, consumer protection organisations and the EDPB[2] on 19 December 2023.
Simpler text
One of the aims of the principles is to facilitate the consumer’s choice by simplifying the text of a cookie banner. For this goal it recommends the creation of more layers on the banner. On the first layer would be the most essential information, meanwhile some information which must be provided under data protection law (i.e. GDPR and the ePrivacy Directive) would be indicated on a second layer where the consumer could check the details. Accordingly, the use of essential cookies is not subject to user’s consent so essential cookies are not needed to explain them on the first layer of the cookie request. Similarly, cookies of legitimate interests cannot serve as a legitimate legal basis for the processing of personal data.
Another simplification would be that if the consumer accepts the tracking in general, the trackers should be listed in a second layer. It should be borne in mind that data protection law requires the information – among others – about the data controllers and the specific purposes of data processing however this information is enough to be placed on the second layer of the cookie banner. The EDPD emphasized in its opinion that if an “accept all” cookies button exists, a “reject all” button is also needed.
Clearer explanation
In the same time when requesting the consent, the consumers should be informed about the business model if the a business earns revenue through tracking-based advertising or by selling the rights to place trackers on consumers’ devices
In the cookie banner – as an important information – the consumer should be informed about the consequences of accepting or refusing the trackers. In this panel, the business model options (such as accepting advertising based on tracking, accepting other types of advertising or agreeing to pay a fee) will be presented together with the consequences in terms of the purpose of trackers in a clear and succinct manner. Taking into consideration the Meta judgement of the European Court of Justice[3] the “pay or give your consent” cannot be acceptable for using a digital service, so if the consumers are not willing to pay, the chance should be given to choose less privacy intrusive forms of advertising (i.e. the contextual advertising instead of behavioural advertising) as well. Revoking the Digital Markets Act[4], gatekeepers are obliged to ensure that the consumers can freely choose to consent to the processing of their personal data, by offering a less personalised but equivalent alternative .If a consumer has selected an advertising model, then he/she doesn’t have to give separate consent for cookies used to manage this selected business model (e.g. cookies to measure performance of a specific ad or to perform contextual advertising). In a data protection law’s perspective, the specific purpose of data processing is still necessary to demonstrate although this information could be provided on the second layer.
Less nudging
The draft sets up a boundary: if the consumer once refuses his consent, the webpage should record it and the consumer cannot be asked to accept cookies in one year period of time. Likewise, applications (i.e web browsers) should allow consumers to record their cookie preferences in advance in order to refuse certain types of advertising models systematically.
The final version of the Cookie pledge principles is planned to be published in spring 2024 (on the Consumer Summit). Afterwards, the stakeholders can adopt these principles on a voluntary basis. As the EDPB has stressed in its opinion, the voluntary adoption of these principles cannot prevent data protection or other authorities (i.e. European Commission against gatekeepers under the DMA; consumer protection authorities under Unfair Commercial Practices Directive (UCPD); digital services coordinators under the Digital Services Act (DSA) to exercise their powers when necessary.
[1] Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023.
[2] EDPB: Reply to the Commission’s Initiative for a voluntary business pledge to simplify the management by consumers of cookies and personalised advertising choices – DRAFT PRINCIPLES (Ref. Ares(2023)6863760), Brussels, 13 December 2023.
[3] Judgement of Meta Platforms and others, C-252/21, ECLI:EU:C:2023:537, 4 July 2023.
[4] Recital (36-(37).
