“C” is for Cookie and Consent

What are Cookies?

Cookies are small text files that are placed by website operators on to the devices of website users. They gather information about the device and send that information back to the website operator. Their functions are varied. They allow a website operator to provide services, identify particular devices, understand website user preferences and so on. Cookies are also used to facilitate targeted advertising.

Necessary & unnecessary Cookies

A distinction is made between necessary and unnecessary cookies.

Necessary cookies are used to transmit communications or to allow website operators to run their websites smoothly and provide services to the website user.

Any cookie which allows website operators to analyse a user’s behaviour with the purpose of targeting them with advertising which they believe is of specific interest to the user based on their preferences, is an unnecessary cookie. These types of cookies were the subject of a recent Court of Justice of the European Union (“CJEU”) decision in the Planet 49 case where judgement issued in October 2019.

What’s new with cookie consent?

In the Planet 49 case the CJEU found that for unnecessary cookies, such as those used for advertising purposes, pre-ticked boxes cannot be relied upon as a means of obtaining consent. There must be an affirmative action on the part of the website user in order for real consent to be gathered. This requires the user to, for example, actively tick a box in order to give consent.

Website operators must also set out clearly in their cookie policies how long cookies will remain on the device of a website user.

How does this affect website operators?

Website operators should:

1. Check with their IT/marketing team to understand what cookies are active on their website.
2. In relation to unnecessary or marketing cookies, the website cookie notice must clearly allow a user to decide if they want marketing cookies on their device so that they can receive ads that are more relevant to them.
3. The user must be able to accept or reject unnecessary cookies.