As many readers will be aware, a key enforcement trend in the privacy sphere is the increasing scrutiny by regulators and activists of cookie banners and the use of cookies. This is a topic that we have been tracking on the Inside Privacy blog for some time. Italian and German data protection authorities have issued guidance within the past three months, adding to guidance coming out of France,  Spain, the UK and at EU level from the EDPB. The EDPB has also recently adopted guidance on the use of “dark patterns” in social media interfaces, setting out best practice to ensure that users can make fully informed decisions. The key compliance recommendations relating to cookies set out by these various guidelines include:

  • allowing only essential technical cookies to be implemented by default, and requiring user consent for all other cookies that are merely helpful or convenient;
  • the need for the giving of consent to non-essential cookies be a clear and positive action, rather than being given, for example, by way of a pre-ticked box or by continued use of a site;
  • preventing consent bundling whereby consent is given in one click for cookies used for more than one purpose without granular controls; and
  • making the withdrawal of consent to cookies as easy as giving consent.

Alongside this increasing prevalence of regulatory guidance on cookies, there has been a wave of letters from activists to companies pointing out apparent shortcomings in compliance, and a corresponding increase in the submission of complaints to national data protection authorities across Europe. Notably, noyb recently sent a second wave of two hundred and seventy draft cookie banner complaints to website operators across Europe. This follows from the initial batch of over five hundred letters sent by the same organisation in May 2021.

Complaints from activist groups such as noyb have focused on the following practices by website operators:

  • inaccurately classifying certain cookies as “essential”;
  • using pre-ticked boxes to obtain consent for cookies;
  • making accepting cookies easier than rejecting them when first landing on a site through design features, such as the use of different colours and levels of contrast;
  • situating the options to accept and reject cookies on different layers of a cookie pop-up;
  • allowing users to reject cookies only via links to separate webpages, rather than utilising an integrated reject button; and
  • making the withdrawal of consent to cookies more difficult than the original giving of that consent.

As can be seen, both regulators and activists have very similar data privacy concerns when it comes to cookies and cookie banners, notably honing in on the need for cookie banners and pop-ups to be designed in such a way that website users are able to make a free and informed choice between consenting to and rejecting cookies.

Throughout this period of increased scrutiny on cookies, Covington’s multi-jurisdictional Data Privacy and Cybersecurity team has been actively assisting clients to navigate the various guidelines and to respond to letters from activists, and is ideally placed to help with any questions you may have.

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young is an experienced tech regulatory lawyer and a vice-chair of Covington’s Data Privacy and Cybersecurity Practice Group. He advises major global companies on their most challenging data privacy compliance matters and investigations. Mark also leads on EMEA cybersecurity matters at the…

Mark Young is an experienced tech regulatory lawyer and a vice-chair of Covington’s Data Privacy and Cybersecurity Practice Group. He advises major global companies on their most challenging data privacy compliance matters and investigations. Mark also leads on EMEA cybersecurity matters at the firm. In these contexts, he has worked closely with some of the world’s leading technology and life sciences companies and other multinationals.

Mark has been recognized for several years in Chambers UK as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” “provides thoughtful, strategic guidance and is a pleasure to work with;” has “great insight into the regulators;” and “is technologically sophisticated and advises on true issues of first impression, particularly in the field of AI.”

Drawing on over 20 years of experience, Mark specializes in:

Providing practical guidance and advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services.
Handling complex regulatory investigations and enforcement actions involving data privacy regulators in the UK, EU and globally, and advising on follow-on litigation risk.
Helping clients respond to cybersecurity incidents, including ransomware, supply chain incidents, state-sponsored attacks, insider threats, personal data breaches, and IP and trade secret theft.
Advising various clients on the EU NIS2 Directive, Cyber Resilience Act (CRA), and other emerging EU, UK, and global cybersecurity laws and regulations.
Advising life sciences companies on industry-specific data privacy issues, including clinical trials, pharmacovigilance, and digital health products and services.
Advising on data privacy compliance in relation to employees and international transfers of data in connection with white collar investigations.
Providing strategic advice and advocacy on a range of UK and EU technology law reform issues relating to data privacy, cybersecurity, eIDs, and software.
Representing clients in connection with references to the Court of Justice of the EU.

Read more about Mark YoungEmail
Show more Show less
Photo of Paul Maynard Paul Maynard

Paul Maynard is special counsel in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online…

Paul Maynard is special counsel in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online platforms. He also advises clients on how to respond to law enforcement demands, particularly where such demands are made across borders.

Paul advises emerging and established companies in various sectors, including online retail, software and education technology. His practice covers advice on new legislative proposals, for example on e-privacy and cross-border law enforcement access to data; advice on existing but rapidly-changing rules, such the GDPR and cross-border data transfer rules; and on regulatory investigations in cases of alleged non-compliance, including in relation to online advertising and cybersecurity.

Read more about Paul MaynardEmail
Show more Show less
Photo of Tomos Griffiths Tomos Griffiths

Tomos is an associate working across the firm’s technology regulatory and competition teams, based in the London office. His practice covers technology and digital markets regulation, competition law, and issues that span the two.

His recent experience includes providing regulatory advice on data…

Tomos is an associate working across the firm’s technology regulatory and competition teams, based in the London office. His practice covers technology and digital markets regulation, competition law, and issues that span the two.

His recent experience includes providing regulatory advice on data protection compliance, technology regulatory investigations, and transactional merger control and foreign direct investment screening matters, primarily in the technology and life sciences sectors.

Read more about Tomos GriffithsEmail
Show more Show less