A lot of websites require users to consent to cookies before being granted access. These are known as cookie walls. Cookies are used to improve the operation of websites, to collect analytical data (analytical cookies) or to track the behaviour of website visitors (tracking cookies). In many cases, website users must give their prior consent to these analytical and tracking cookies.
Discussion
The debate about whether cookie walls are allowed has been going on for years. According to privacy legislation, consent must be freely given and, consequently, users may not be adversely affected if they withhold their consent. Many organisations consider it defensible to argue that consent is freely given if the user can opt for an alternative without a cookie wall, such as the NOS for news bulletins.
At European level, there have also been discussions about the permissibility of cookie walls in the context of the new ePrivacy Regulation. The most recent proposal for the draft Regulation (19 October 2018) states that the content of websites may be made dependent on the user giving consent, provided that the user can also opt for the same content from the same provider without consent being required.
Dutch Data Protection Authority adopts a position: cookie walls are prohibited Surprisingly, the DDPA decided not to await the outcome of these discussions and published its own position on its website. Its position is that websites that only allow users access if they consent to tracking cookies or other similar means for tracking and recording user behaviour by means of software or other digital methods do not comply with the GDPR.
The DDPA has also indicated that it has started carrying out checks and imposing enforcement measures.
Is the DDPA's position an oversimplification?
The DDPA's position is a very strict interpretation of the legislation and it is highly questionable. The GDPR merely requires consent to be freely given; it does not include an absolute prohibition. It is justifiable to argue that consent is freely given if an alternative to the website, without cookies, is provided.
In addition, the question is whether the DDPA is out of line. The fact is that the Dutch Authority for Consumers & Markets ("ACM") is responsible for enforcing cookie legislation (the Telecommunications Act (Telecommunicatiewet)). The ACM and the DDPA therefore made arrangements about their cooperation in 2016. It would have been logical for these supervisory authorities to publish a joint position on cookie walls.
What next?
Given the DDPA's position, companies and organisations will now have to re-assess their cookie policy. Many of them will have to choose whether to abandon cookie walls to avoid enforcement by the DDPA or to explain clearly why there is a free choice in their own specific cases.
Whether or not this interpretation will put an end to the lack of clarity about cookie walls will only become clear once the final version of the ePrivacy Regulation is published. We will keep you up to date!
A lot of websites require users to consent to cookies before being granted access. These are known as cookie walls. Cookies are used to improve the operation of websites, to collect analytical data (analytical cookies) or to track the behaviour of website visitors (tracking cookies). In many cases, website users must give their prior consent to these analytical and tracking cookies.
Discussion
The debate about whether cookie walls are allowed has been going on for years. According to privacy legislation, consent must be freely given and, consequently, users may not be adversely affected if they withhold their consent. Many organisations consider it defensible to argue that consent is freely given if the user can opt for an alternative without a cookie wall, such as the NOS for news bulletins.
At European level, there have also been discussions about the permissibility of cookie walls in the context of the new ePrivacy Regulation. The most recent proposal for the draft Regulation (19 October 2018) states that the content of websites may be made dependent on the user giving consent, provided that the user can also opt for the same content from the same provider without consent being required.
Dutch Data Protection Authority adopts a position: cookie walls are prohibited Surprisingly, the DDPA decided not to await the outcome of these discussions and published its own position on its website. Its position is that websites that only allow users access if they consent to tracking cookies or other similar means for tracking and recording user behaviour by means of software or other digital methods do not comply with the GDPR.
The DDPA has also indicated that it has started carrying out checks and imposing enforcement measures.
Is the DDPA's position an oversimplification?
The DDPA's position is a very strict interpretation of the legislation and it is highly questionable. The GDPR merely requires consent to be freely given; it does not include an absolute prohibition. It is justifiable to argue that consent is freely given if an alternative to the website, without cookies, is provided.
In addition, the question is whether the DDPA is out of line. The fact is that the Dutch Authority for Consumers & Markets ("ACM") is responsible for enforcing cookie legislation (the Telecommunications Act (Telecommunicatiewet)). The ACM and the DDPA therefore made arrangements about their cooperation in 2016. It would have been logical for these supervisory authorities to publish a joint position on cookie walls.
What next?
Given the DDPA's position, companies and organisations will now have to re-assess their cookie policy. Many of them will have to choose whether to abandon cookie walls to avoid enforcement by the DDPA or to explain clearly why there is a free choice in their own specific cases.
Whether or not this interpretation will put an end to the lack of clarity about cookie walls will only become clear once the final version of the ePrivacy Regulation is published. We will keep you up to date!