As the UK counts down to the 26 May “cookie deadline” there have been some important developments in other key European jurisdictions.
Spain has recently (belatedly) implemented its version of the cookie rule. Commentary and reports are varied as to whether the new Spanish law requires express “opt-in” consent. This also highlights an important point regarding the meaning of consent, which equally applies to the position in the UK.
Where the law requires consent, this requires that a positive indication of the individual’s wishes must be collected. Yes, the consent must be “freely given, specific and informed” (and, under the new Data Protection Regulation, “explicit”) but this does not necessarily mean a “tick box” consent. Other mechanisms are available to demonstrate that consent has been collected. It appears, therefore, that in Spain (like in the United Kingdom) a robust implied consent approach to the cookies rule, with sufficient information and transparency, will be the tentative approach many organisations will seek to adopt unless or until there is clear regulatory guidance or enforcement to the contrary.
Separately in France, the CNIL has issued recent guidance in relation to the use of analytical cookies. It is given clear guidance that, subject to certain prescribed technical conditions, the new cookies rule will not apply to the use of analytical cookies. While, in the UK, the ICO has been made clear that breaches of the new cookies rule relating purely to analytical cookies are unlikely to be the focus of its enforcement activities, I am sure many UK website operators would have appreciated the ICO adopting the CNIL’s clear and pragmatic approach.
The ICO has also confirmed in its latest newsletter that it will be shortly updating its own guidance on compliance with the new cookies rule to ensure that the emerging best practice in cookie consent is shared across the industry. Better late than never.
