The E-Privacy Directive 2009/136/EC states that the use and storage of data by cookies is only permitted if the user has agreed (“Opt-In”). The EU legislature is particularly targeting “tracking & targeting” cookies which are used to target advertising based on personality profiles of the users. As a result, users should be informed of, and agreed to, tracking actions (“opt-in”) before the tracking begins and must be able to opt out at any time.

However,  in Article 5 (3), the EU does not clearly state how permission must be obtained in order to be valid.

 Scope for national legislators

This gives national legislatures a wide scope for interpretation which, in practice, leads to difficulties. The question which needs answering is whether a user must actively consent to the use of cookies (“opt-in”) or whether it is sufficient for the user to have the option of objecting to the use of cookies (“opt-out”) .

The wide scope for interpretation has resulted in EU Member States implementing Article 5 (3) differently from country to country.  Because the original, unclear text of the directive has often been adopted into national law, related legal uncertainties remain.

In Germany, the directive has not yet been drafted into implemented law.  Mr. Peter Schaar, former Federal Data Protection Supervisor, argued that the EU directive was sufficiently specific to be directly applicable in accordance with the principle of European law. Nevertheless, many German website operators have yet to act. The reason for this is the German Data Protection Act. Article 15 (3) of this Act stipulates that users must be informed of any and all tracking measures used and that users must be given the option to refuse such tracking (“opt-out”).  As a result, most German companies  simply retained the cookie warning in their privacy statements.

Google the privacy advocate?

Now Google is now breathing life into the cookie directive in Germany. In the past, the search engine giant had not shown itself to be particularly interested in data protection. In September 2015, however,  Google insisted that a cookie warning be available on all sites in Germany and in all apps that use Google products, such as DoubleClick for Publishers, DoubleClick Ad Exchange or Google AdSense. Google’s actions However, are less directed at change than at self preservation against possible harsher laws and sanctions — especially in light of the fact that Google has no cookie warning obligation on widespread tools and programs such as Google AdWords and Google Analytics.  These tools, of course, also store promotional cookies.

In search of a practical technical solution

There are also different approaches in selecting the technical means by which consent is obtained on a website. Most website operators rely on an “opt-out” solution in the form of pop-ups or banners: the user is informed about data protection, tracking and targeting tools are explained, and an “opt-out” for each tool is then offered.

A more user-friendly — and certainly the European legislature’s intended — solution would be if the cookie warning already contained an opt-out in order to turn off all advertising. This solution is mainly found in apps.

Is there any need for action?

If you’re using DoubleClick for Publishers, DoubleClick Ad Exchange, or Google AdSense, you would already have a cookie warning on your site or app. If not, you should quickly take action, as Google’s official conversion period ended on September 30, 2015.

As a result of more widespread use – fueled by Google – cookie warnings are becoming the standard. Any departure from this standard would and should raise questions among users.

There may still be need for action even if you have tracking tools in place.  If privacy policies  don’t immediately offer an “opt-out” in their tools, you should compensate in the short term, in order to avoid violation of German law.

Companies operating in several EU Member States and dealing with different implementations of the “cookie scheme” should always follow the strictest standards.

Related blog posts

Back to home