The DPC stressed that the sweep was not a broadscale investigation of the adtech industry or the real-time bidding advertising framework; these issues are the subject of separate DPC inquiries.
Key findings of the sweep include:
- Non-necessary cookies set on landing: On almost all the websites examined, cookies were set immediately on the landing page. This included, in many cases, non-necessary cookies.
- Pre-checked consent boxes: 26% of the responding organizations presented pre-checked boxes to signal consent to cookies, including to marketing and analytics cookies.
- Misclassification of cookies as “necessary”: Many organizations miscategorized the cookies deployed on their websites as “necessary” or “strictly necessary.”
- Bundling of consent for all purposes: For most organizations, consent was “bundled,” i.e., users were unable to provide consent to particular purposes for which cookies were being used.
- No visible functionality to change cookie settings: Most websites did not offer tools for users to vary or withdraw cookie choices at a later stage, despite the deployment of third-party vendors’ CMPs by some organizations.
About 15 of the 38 organizations who responded signaled either that they were aware they may not be compliant with the existing rules, or that they had identified improvements that they could make to their websites in order to demonstrate compliance. However, “it was clear from some responses,” the DPC stated, “that even the changes proposed by controllers may not serve to bring them into full compliance.”
New Cookie Guidance
Key takeaways from the DPC’s new cookie guidance include:
- Organizations must ensure that no non-necessary cookies and similar technologies (including local storage objects or “flash” cookies, software development kits (“SDKs”), pixel trackers (or pixel gifs), “like” buttons and social sharing tools, and device fingerprinting technologies) are set on the landing page of their site or app;
- Obtaining users’ consent by implementing a cookie banner or pop-up is acceptable, provided that:
- the cookie banner or pop-up is not designed in a way that “nudges” a user into accepting cookies over rejecting them. In practice, if there is an “accept” button on the banner, the banner must give equal prominence to a “reject” button, or to an option which brings users to a second layer of information and allows them to manage their cookie settings; and
- this second layer of information must provide more detailed information about the types and purposes of cookies or other technologies being set, and the third parties who will process information collected when those cookies and similar technologies are deployed. It also must provide users with options to accept or reject such cookies/similar technologies by cookie type and purpose, e.g., via checkboxes that must not be pre-checked, or sliders that must not be set to “on” by default. Checkboxes or sliders should be clearly marked as “on” or “off”, even if they also have a binary color choice so that users do not have to guess at their functionality.
- Users must also be able to change their cookie preferences at any time, e.g., via a cookie button (or a “radio button”) available on each web page, which reveals sliders or on/off options.
- Any record of consent must be backed up by demonstrable organizational and technical measures that ensure a user’s expression of consent (or withdrawal) can be effectively acted on.
- Analytics cookies, targeting cookies and marketing cookies require users’ prior consent. However, first-party analytics cookies are considered potentially low risk and therefore are unlikely to be a priority for any formal enforcement action by the DPC.
- Organizations must also must examine the role of the third parties using cookies and similar technologies on their website or app as (joint) data controllers or data processors. In particular, they must examine the possible joint data controller issues arising from the use of third-party assets and plugins. Where necessary, they must put in place the appropriate data processing agreement with these third parties, which must reflect the actual facts of the processing.
The DPC made it clear that they expect organizations (acting as data controllers) to comply with the current cookie law rules. Organizations have a six-month window to get in compliance with the DPC’s new cookie guidance; after that period, the DPC may take action to enforce the guidance.