Cookie banners follow us around like a swarm of irritating flies. Some are unnecessary, others only give the impression of GDPR compliance, and most fail to meet the rules. Here are the key points to consider.<\/p>\n\n\n\n
The requirement to obtain visitors\u2019 prior consent for certain website services comes not from the GDPR itself, but from Article 5(3) of the ePrivacy Directive:<\/p>\n\n\n\n
Member States shall ensure that the storing of information or the gaining of access to information already stored in the terminal equipment of a subscriber or user is only allowed if the subscriber or user concerned has given their consent, having been provided with clear and comprehensive information, among other things, about the purposes of the processing. ...<\/p>\n\n\n\n
<\/p>\n\n\n\n
Because the ePrivacy Directive takes precedence over the GDPR, these services cannot rely on \u201clegitimate interests\u201d under Article 6(1)(f) GDPR. Instead, consent under Article 6(1)(a) applies.
The GDPR, in turn, sets out how that consent must be obtained.<\/p>\n\n\n\n
<\/p>\n\n\n\n
a. Consent is not required, for example, for:<\/strong><\/p>\n\n\n\n As a general rule, no consent is required<\/strong> for cookies or services needed to run the website or provide a service the user has explicitly requested. If these are the only features you use, you do not need a cookie or consent banner; you simply need to update your privacy policy accordingly.<\/p>\n\n\n\n Those familiar \u201cWe use cookies, blah blah blah\u2026 OK\u201d<\/strong><\/em> banners are unnecessary. They confuse visitors and make them less likely to pay attention.<\/p>\n\n\n\n Tools used purely for statistical web analysis, for example to improve a website, usually do not require consent either. Matomo falls into this category, particularly as it can be hosted on your own servers. These services can rely on legitimate interests under Article 6(1)(f) GDPR. In some cases, it makes sense to carry out and document a balancing-of-interests assessment. That is a data protection issue, however, rather than a question of banner design.<\/p>\n\n\n\n Google Analytics<\/strong> is an exception: supervisory authorities regard it as a tracking tool, even if the website owner only wants visitor statistics. Google Analytics<\/strong> therefore requires consent.<\/strong><\/p>\n\n\n\n b. Consent is required for:<\/strong><\/p>\n\n\n\n One alternative to social media plugins is Heise\u2019s two-click solution (the Shariff button). You can also use images or icons that simply link to the relevant platform. In that case, consent is not required; your privacy policy just needs to include the relevant information. You could add a notice that appears on hover, such as \u201cYou will be taken to Facebook\u201d<\/strong><\/em>. That gives visitors an extra layer of clarity.<\/p>\n\n\n\n For any feature that requires consent, the key rule is to obtain it BEFORE<\/strong> collecting or transmitting data.<\/p>\n\n\n\n At the time discussed here, there was still no consensus. Some data protection experts expected the planned ePrivacy Regulation, originally intended to take effect alongside the GDPR, to require prior consent for these services too. They also saw the Court of Justice of the EU\u2019s autumn 2019 rulings and the German Federal Court of Justice\u2019s May 2020 ruling as pointing in that direction.<\/p>\n\n\n\n The Bavarian State Office for Data Protection Supervision (BayLDA) stated on its website that videos could be embedded without prior consent if playback began only after an active click and no data was transferred beforehand, using a two-click solution or Embetty. It also advised embedding YouTube videos in privacy-enhanced mode (no-cookie).<\/p>\n\n\n\n BayLDA took a similar view of Google Maps: map content should only load when the visitor actively requests it, for example with an extra click in a two-click solution.<\/p>\n\n\n\n I asked BayLDA about this. At the time of my enquiry, the authority confirmed the interpretation described above, but said it still needed to examine the courts\u2019 reasoning in detail. That review could lead to a change in its position.<\/p>\n\n\n\n If you want to plan ahead, consider obtaining consent for these services too. There is always room to take additional data protection precautions.<\/p>\n\n\n\n Consent must be obtained IN ADVANCE<\/strong>, be INFORMED<\/strong> and be FREELY GIVEN<\/strong>. In practice:<\/p>\n\n\n\n a. IN ADVANCE:<\/strong> Note:<\/strong> A genuine choice also means visitors can use the website even if they refuse optional services.<\/p>\n\n\n\n No payment information required! No automatic renewal!\nYour Trackboxx ready to go in 1 minute.<\/p><\/div>\n\n\n\n\n
\n
3. Maps, video and streaming services<\/h2>\n\n\n\n
4. What valid consent requires<\/h2>\n\n\n\n
When someone first opens the website, scripts that could collect user data and pass it to third parties must remain disabled.
b. INFORMED:<\/strong>
Explain the services briefly, using clear, simple language and an easy-to-follow layout. The aim is to inform visitors, not overwhelm them.
c. FREELY GIVEN:<\/strong>
Do not pre-tick consent boxes. Visitors must actively agree, rather than have to opt out.<\/p>\n\n\n\n
Broad statements such as \u201cThis site uses cookies for analytics and advertising\u201d or \u201c\u2026to improve your browsing experience\u201d are not enough on their own. They do not explain clearly what happens to the data.<\/p>\n\n\n\nTry Trackboxx free for 30 days now<\/h3><\/div>\n\n\n\n