Article 29 Working Party Provides Guidance On Obtaining Valid Cookie Consent In The EU

Author:Ms Charley Lozada
Profession:Proskauer Rose LLP

This past month, the European Union's Article 29 Data Protection Working Party (the "Working Party") issued the Working Document 02/2013 providing new guidance on obtaining consent for cookies ("Working Document"). The Working Document sets forth various mechanisms which can be utilized by websites to obtain consent for the use of cookies in compliance with all EU Member State legal requirements.

The amended e-Privacy Directive 2002/58/EC, adopted in 2009 and implemented in all EU Member States, requires website operators to obtain users' consent for the use of cookies or similar tracking technologies. The Working Document elaborates on the Working Party's prior opinion, as explained in the Working Party's Opinion of July 13, 2011 on the concept of consent in particular. Specifically if a website operator wants to ensure that a consent mechanism satisfies each EU Member State requirement, such consent mechanism should include each of the main elements: (1) specific information, (2) prior consent, (3) indication of wishes expressed by user's active behavior and (4) an ability to choose freely.

Specific Information: The Working Party states that websites should implement a mechanism that provides for "for a clear, comprehensive and visible notice on the use of cookies, at the time and place where consent is sought." Users must be able to access all necessary information about the different types or purposes of cookies being used by the website.

The Working Paper indicates that necessary information includes:

identification of all of the types of cookies used; the purpose(s) of the cookies; if relevant, an indication of possible cookies from third parties; if relevant, third party access to data collected by the cookies; the data retention period (i.e. the cookie expiry date); and typical values and other technical information. Users must also be informed about the ways that they can accept all, some or no cookies and how to change their cookie settings in the future.

Timing: Consent must be obtained before data processing begins, i.e. on the entry page. The Working Party recommends that websites implement a consent solution in which no cookies are set to a user's device (other than those that fall under an exception and thus do not require the user's consent) until that user has...

To continue reading