Privacy & Information Security Law Blog

On June 7, 2012, the Article 29 Working Party (the “Working Party”) adopted an Opinion analyzing the exemptions to the prior opt-in consent requirement for cookies. Although the Opinion focuses on cookies, the Working Party also notes that the same analysis applies to any technology allowing information to be stored or accessed on a user’s computer or mobile device.

Article 5.3 of the revised e-Privacy Directive 2002/58/EC (the “cookie clause”) includes two exemptions to the requirement to obtain prior opt-in consent for the use of cookies: (1) if the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network,” or (2) if the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.”

The Opinion includes the following general guidelines regarding the application of these exemptions:

• A cookie that satisfies one of the two exemption criteria also must have a “lifespan that is in direct relation to the purpose it is used for, and must be set to expire once it is not needed, taking into account the reasonable expectations of the average user or subscriber.” This would usually mean the end of a browser session.
• “First party” session cookies are far more likely to be exempted from the consent requirement than “third party” persistent cookies. However, in order to determine whether or not a cookie is exempted from consent, the data protection risk must be assessed on the basis of the purpose(s) of processing rather than the information contained within the cookie.
• A cookie may perform multiple functions, but it is only exempt from the consent requirement for the purposes that satisfy the exemption criteria. Accordingly, consent must be sought for any purposes that do not fall within the scope of the exemptions. A cookie may only be completely exempted from consent, “if all the distinct purposes for which the cookie is used are individually exempted from consent.” The Working Party helpfully adds that even if several cookies are used for several different purposes, a single point of information and consent, presented in a clear and comprehensive manner, should be sufficient in most cases.

The Opinion further offers a list of specific cookies that may, under certain conditions, be exempted from the consent requirement. These include:

• “User-input” cookies, such as those used to keep track of the user’s input, or to keep track of items selected in a shopping cart.
• Authentication cookies are exempted, but generally should expire once the session ends. Consent for persistent authentication cookies can be obtained using a tick box next to the submission form that informs the user about the cookies (e.g. “Remember me (use of cookies)”).
• User-centric security cookies are exempted, unless they relate to services not explicitly requested by the user.
• Multimedia player session cookies, or “flash cookies,” if they do not contain any additional information not necessary to the multimedia service, are exempted but should expire once the session ends.
• Load balancing cookies are exempted from consent, as they are considered necessary for carrying out a communication over a network.
• User interface customization cookies, used to remember a user’s preferences (e.g. language preferences, font or display preferences, etc.) should only be kept for the duration of a session, unless there is a clear indication that the user consented to the preferences being retained across sessions.
• Social plug-in content sharing cookies are only exempted from consent for logged-in social media users, and only for so long as they remain logged-in. Consent should be obtained from users who are not members of the social network and from members who have logged-out of the network.

According to the Opinion, the following cookies are not covered by the exemptions, and thus require prior opt-in consent:

• Social plug-in tracking cookies
• Cookies used for third-party advertising (as described in detail in the Working Party’s Opinions 2/2010 and 16/2011)
• First-party analytics cookies, though the Working Party recognized the low privacy risk represented by these cookies, and accepts that the usual safeguards (i.e., use limited to aggregate statistical purposes, provision of clear information to the user, adequate technical privacy safeguards, etc.) may be enough if they include simple means of opting-out of the collection of information and if identifiable data such as IP addresses are thoroughly anonymized. The Working Party takes the view that, if in the future the e-Privacy Directive is revised again, the European legislator may want to add first-party analytics cookies as a third exemption to the general consent requirement.