As many readers will be aware, a key enforcement trend in the privacy sphere is the increasing scrutiny by regulators and activists of cookie banners and the use of cookies. This is a topic that we have been tracking on the Inside Privacy blog for some time. Italian and German data protection authorities have issued guidance within the past three months, adding to guidance coming out of France,  Spain, the UK and at EU level from the EDPB. The EDPB has also recently adopted guidance on the use of “dark patterns” in social media interfaces, setting out best practice to ensure that users can make fully informed decisions. The key compliance recommendations relating to cookies set out by these various guidelines include:

  • allowing only essential technical cookies to be implemented by default, and requiring user consent for all other cookies that are merely helpful or convenient;
  • the need for the giving of consent to non-essential cookies be a clear and positive action, rather than being given, for example, by way of a pre-ticked box or by continued use of a site;
  • preventing consent bundling whereby consent is given in one click for cookies used for more than one purpose without granular controls; and
  • making the withdrawal of consent to cookies as easy as giving consent.

Alongside this increasing prevalence of regulatory guidance on cookies, there has been a wave of letters from activists to companies pointing out apparent shortcomings in compliance, and a corresponding increase in the submission of complaints to national data protection authorities across Europe. Notably, noyb recently sent a second wave of two hundred and seventy draft cookie banner complaints to website operators across Europe. This follows from the initial batch of over five hundred letters sent by the same organisation in May 2021.

Complaints from activist groups such as noyb have focused on the following practices by website operators:

  • inaccurately classifying certain cookies as “essential”;
  • using pre-ticked boxes to obtain consent for cookies;
  • making accepting cookies easier than rejecting them when first landing on a site through design features, such as the use of different colours and levels of contrast;
  • situating the options to accept and reject cookies on different layers of a cookie pop-up;
  • allowing users to reject cookies only via links to separate webpages, rather than utilising an integrated reject button; and
  • making the withdrawal of consent to cookies more difficult than the original giving of that consent.

As can be seen, both regulators and activists have very similar data privacy concerns when it comes to cookies and cookie banners, notably honing in on the need for cookie banners and pop-ups to be designed in such a way that website users are able to make a free and informed choice between consenting to and rejecting cookies.

Throughout this period of increased scrutiny on cookies, Covington’s multi-jurisdictional Data Privacy and Cybersecurity team has been actively assisting clients to navigate the various guidelines and to respond to letters from activists, and is ideally placed to help with any questions you may have.

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young is an experienced tech regulatory lawyer and a vice-chair of Covington’s Data Privacy and Cybersecurity Practice Group. He advises major global companies on their most challenging data privacy compliance matters and investigations. Mark also leads on EMEA cybersecurity matters at the…

Mark Young is an experienced tech regulatory lawyer and a vice-chair of Covington’s Data Privacy and Cybersecurity Practice Group. He advises major global companies on their most challenging data privacy compliance matters and investigations. Mark also leads on EMEA cybersecurity matters at the firm. In these contexts, he has worked closely with some of the world’s leading technology and life sciences companies and other multinationals.

Mark has been recognized for several years in Chambers UK as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” “provides thoughtful, strategic guidance and is a pleasure to work with;” and has “great insight into the regulators.” According to the most recent edition (2024), “He’s extremely technologically sophisticated and advises on true issues of first impression, particularly in the field of AI.”

Drawing on over 15 years of experience, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology, e.g., AI, biometric data, and connected devices.
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
  • Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • Counseling ad networks (demand and supply side), retailers, and other adtech companies on data privacy compliance relating to programmatic advertising, and providing strategic advice on complaints and claims in a range of jurisdictions.
  • Advising life sciences companies on industry-specific data privacy issues, including:
    • clinical trials and pharmacovigilance;
    • digital health products and services; and
    • engagement with healthcare professionals and marketing programs.
  • International conflict of law issues relating to white collar investigations and data privacy compliance (collecting data from employees and others, international transfers, etc.).
  • Advising various clients on the EU NIS2 Directive and UK NIS regulations and other cybersecurity-related regulations, particularly (i) cloud computing service providers, online marketplaces, social media networks, and other digital infrastructure and service providers, and (ii) medical device and pharma companies, and other manufacturers.
  • Helping a broad range of organizations prepare for and respond to cybersecurity incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, supply chain incidents, and state-sponsored attacks. Mark’s incident response expertise includes:
    • supervising technical investigations and providing updates to company boards and leaders;
    • advising on PR and related legal risks following an incident;
    • engaging with law enforcement and government agencies; and
    • advising on notification obligations and other legal risks, and representing clients before regulators around the world.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of UK and EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Read more about Mark YoungEmail
Show more Show less
Photo of Paul Maynard Paul Maynard

Paul Maynard is special counsel in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online…

Paul Maynard is special counsel in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online platforms. He also advises clients on how to respond to law enforcement demands, particularly where such demands are made across borders.

Paul advises emerging and established companies in various sectors, including online retail, software and education technology. His practice covers advice on new legislative proposals, for example on e-privacy and cross-border law enforcement access to data; advice on existing but rapidly-changing rules, such the GDPR and cross-border data transfer rules; and on regulatory investigations in cases of alleged non-compliance, including in relation to online advertising and cybersecurity.

Read more about Paul MaynardEmail
Show more Show less
Photo of Tomos Griffiths Tomos Griffiths

Tomos Griffiths is an associate working across the technology regulatory and competition groups in London.

Tomos joined the firm as a trainee solicitor in 2021, qualifying in 2023. His practice covers technology regulation, competition law, and regulation that spans the two. His recent…

Tomos Griffiths is an associate working across the technology regulatory and competition groups in London.

Tomos joined the firm as a trainee solicitor in 2021, qualifying in 2023. His practice covers technology regulation, competition law, and regulation that spans the two. His recent experience includes advising clients on data protection compliance, foreign direct investment screening, and competition law litigation.

As a trainee solicitor, Tomos also gained experience in capital markets and commercial litigation for clients in the technology and life sciences sectors.

Read more about Tomos GriffithsEmail
Show more Show less