On December 19, 2023, the European Commission (“EU Commission”) released draft pledging principles of cookies after having consulted the European Data Protection Board (“EDPB”) which gave its opinion on their compliance with e-Privacy Directive and EU Regulation 2016/679 (“GDPR”).
The cookie pledge initiative was developed by the EU Commission in response to concerns regarding the so-called “cookie fatigue” phenomenon and consists of a voluntary business pledge to simplify the management of cookies and personalised advertising choices by consumers.
The draft pledging principles would ensure that users receive concrete information on how their data is processed, as well as on the consequences of accepting different types of cookies. Users would therefore have greater control over the processing of their data.
Before explaining the principles, it is useful to clarify the context in which this initiative was developed.
Background
During the European Consumer Summit in March 2023, the Commissioner for Justice and Consumers unveiled the EU Commission’s proactive initiative to collaborate with key players in addressing consumer concerns regarding cookies and targeted advertising. The initial roundtable discussions, held in April 2023, were limited to EU-level trade entities, consumer associations, and global businesses, as national trade associations or businesses couldn't participate at that stage.
Subsequent to the April roundtable, multiple working groups were established, and a dedicated digital “wiki” platform was set up for technical-level collaboration. Pledge participants were encouraged to contribute written insights, exchange perspectives, and engage in drafting the guiding “principles” through this wiki platform. The working groups reconvened in July, highlighting the necessity for further thorough discussion. As a result, technical meetings were convened in October to delve deeper into various topics, including consumer comprehension of diverse advertising models, their privacy preferences, and the viability of alternative advertising approaches.
Pledging principles in details
Specifically, the draft cookie pledging principles specify that:
- Essential cookies: given that such cookies do not require consent, the omission of their details within the consent request would streamline the information users need to read and understand. Furthermore, in accordance with Article 5(3) of the ePrivacy Directive, legitimate interest cannot serve as a legal basis for the processing of personal. Hence, it should be excluded from the cookie banner, it being understood that any subsequent data processing based on legitimate interest ought to be explained in supplementary layers.
- Content financed at least partially by advertising: when a business earns revenue through tracking-based advertising or by selling the rights to place trackers on consumers’ devices, consumers should be informed about this business model concurrently with the request for cookie consent. Presenting complex cookie banners and subsequently issuing a “pay or leave” ultimatum after consumers decline consent might be seen as manipulative.
- Clear presentation of the business model: this will include clear explanations of the consequences of accepting or not-accepting trackers. Most cookies are used to implement a business model and therefore this concomitance should be easily described, understood and implemented in one joint panel regrouping the agreements under consumer law and consent under the e-Privacy/GDPR law. In this panel, the business model options (i.e. accepting advertising based on tracking, accepting other types of advertising or agreeing to pay a fee) will be presented together with the consequences in terms of the purpose of trackers, and this in plain and simple language.
- Alternative advertising options: considering the small percentage of consumers willing to pay for various types of online content and the fact that consumers visit numerous websites daily, requesting payment doesn't seem to be a plausible substitute for tracking their online behavior for advertising, which legally necessitates obtaining consent.
- Aggregate cookie consent: consent to cookies for advertising purposes should not be necessary for every single tracker, and more information on the types of cookies used for advertising purposes should be given in a second layer, with the possibility to make a more fine-grained selection.
- No separate consent for cookies used to manage the advertising model selected by the consumer (e.g. cookies to measure performance of a specific ad or to perform contextual advertising) will be required as the consumers have already expressed their choice to one of the business models.
- One-year cookie consent expiration: the consumer should not be asked to accept cookies in one year period of time since the last request. The cookie to record the consumer’s refusal is necessary to respect his/her choice. Recording such choice is indispensable for an efficient management of a website and for respecting consumers’ choices.
- App-based cookie preferences: signals from applications providing consumers with the possibility to record their cookie preferences in advance with at least the same principles as described above will be accepted.
Next Steps
The EU Commission aims to finalize the draft cookie pledging principles in January 2024 and present a final version at the Consumer Summit in April 2024. Stakeholders will then be invited to discuss and adopt these principles on a voluntary basis.
In any case, as clarified by the EDPB, adherence to the cookie pledge principles by organisations does not equal compliance with the GDPR or ePrivacy Directive and thus the data protection authorities remain competent to exercise their powers when necessary.
