Privacy & Information Security Law Blog

On April 6, 2020, the Irish Data Protection Commission (the “DPC”) published a report summarizing the DPC’s findings following a cookie sweep of select websites across a range of sectors, as well as a new guidance note on the use of cookies and other tracking technologies.

Background

Between August and December 2019, the DPC carried out a “sweep,” sending a questionnaire to 40 organizations and examining the use of cookies and similar technologies on a selection of popular websites in Ireland across a range of sectors. The DPC’s aim was to examine how cookies and similar technologies are deployed, and to establish how and whether organizations are (1) complying with the current Irish cookie law rules, implementing the EU ePrivacy Directive into Irish law (the “Irish ePrivacy Regulations”), and in particular; and (2) whether users’ consent for non-necessary cookies or tracking technologies is being obtained in line with the requirements of the EU General Data Protection Regulation (“GDPR”).

The DPC stressed that the sweep was not a broadscale investigation of the adtech industry or the real-time bidding advertising framework; these issues are the subject of separate DPC inquiries.

DPC Findings

Key findings of the sweep include:

• Non-necessary cookies set on landing: On almost all the websites examined, cookies were set immediately on the landing page. This included, in many cases, non-necessary cookies.
• Pre-checked consent boxes: 26% of the responding organizations presented pre-checked boxes to signal consent to cookies, including to marketing and analytics cookies.
• Implied consent: Two-thirds of the organizations specifically stated that they were relying on (1) a model of “implied consent” to set cookies, based on the wording of their cookie banners (e.g., “by continuing to browse this site you consent to the use of cookies”); and/or (2) the user controlling cookies via their browser settings.
• Misclassification of cookies as “necessary”: Many organizations miscategorized the cookies deployed on their websites as “necessary” or “strictly necessary.”
• Badly designed cookie banners and consent-management platforms (“CMPs”): Badly designed cookie banners and CMPs were also a feature on some websites (e.g., cookie banners offering no choice other than an “accept” button without any link to additional information about cookies, and with the cookies policy or privacy policy in the page footer obscured by the banner; and CMPs using sliders with a binary color choice only, i.e., sliders which are not marked clearly to denote the “on” and “off” positions).
• Bundling of consent for all purposes: For most organizations, consent was “bundled,” i.e., users were unable to provide consent to particular purposes for which cookies were being used.
• No visible functionality to change cookie settings: Most websites did not offer tools for users to vary or withdraw cookie choices at a later stage, despite the deployment of third-party vendors’ CMPs by some organizations.

About 15 of the 38 organizations who responded signaled either that they were aware they may not be compliant with the existing rules, or that they had identified improvements that they could make to their websites in order to demonstrate compliance. However, “it was clear from some responses,” the DPC stated, “that even the changes proposed by controllers may not serve to bring them into full compliance.”

New Cookie Guidance

Key takeaways from the DPC’s new cookie guidance include:

• Organizations must ensure that no non-necessary cookies and similar technologies (including local storage objects or “flash” cookies, software development kits (“SDKs”), pixel trackers (or pixel gifs), “like” buttons and social sharing tools, and device fingerprinting technologies) are set on the landing page of their site or app;
• Obtaining users’ consent by implementing a cookie banner or pop-up is acceptable, provided that:
  • the cookie banner or pop-up outlines that the organization is requesting consent for the use of cookies and similar technologies for specific purposes, and allows the user to reject non-necessary cookies and similar technologies, or to request more information about the use of cookies and similar technologies. Wording such as “by continuing to use the site, you consent to the use of cookies” is no longer permissible;
  • the cookie banner or pop-up is not designed in a way that “nudges” a user into accepting cookies over rejecting them. In practice, if there is an “accept” button on the banner, the banner must give equal prominence to a “reject” button, or to an option which brings users to a second layer of information and allows them to manage their cookie settings; and
  • this second layer of information must provide more detailed information about the types and purposes of cookies or other technologies being set, and the third parties who will process information collected when those cookies and similar technologies are deployed. It also must provide users with options to accept or reject such cookies/similar technologies by cookie type and purpose, e.g., via checkboxes that must not be pre-checked, or sliders that must not be set to “on” by default. Checkboxes or sliders should be clearly marked as “on” or “off”, even if they also have a binary color choice so that users do not have to guess at their functionality.
• Users must also be able to change their cookie preferences at any time, e.g., via a cookie button (or a “radio button”) available on each web page, which reveals sliders or on/off options.
• If a cookie is used to store a record that a user has given consent to the use of cookies, this cookie should have a lifespan of six months. Like the CNIL in France, the DPC considers obtaining users’ renewed consent after six months appropriate.
• Any record of consent must be backed up by demonstrable organizational and technical measures that ensure a user’s expression of consent (or withdrawal) can be effectively acted on.
• Analytics cookies, targeting cookies and marketing cookies require users’ prior consent. However, first-party analytics cookies are considered potentially low risk and therefore are unlikely to be a priority for any formal enforcement action by the DPC.
• Organizations must also must examine the role of the third parties using cookies and similar technologies on their website or app as (joint) data controllers or data processors. In particular, they must examine the possible joint data controller issues arising from the use of third-party assets and plugins. Where necessary, they must put in place the appropriate data processing agreement with these third parties, which must reflect the actual facts of the processing.

The DPC made it clear that they expect organizations (acting as data controllers) to comply with the current cookie law rules. Organizations have a six-month window to get in compliance with the DPC’s new cookie guidance; after that period, the DPC may take action to enforce the guidance.