Website operators wrestling with the new rule will appreciate the clarity of some of the guidance that is contained in the opinion. And they may find some good news that these exemptions may have a slighter broader application than had previously been thought.
The Working Party elected to focus this opinion of the breadth of the exemptions (rather than the tricky question of consent, which it has covered in previous opinions). As a brief reminder, these exemptions apply if:
- the cookie is for the sole purpose of carrying out the transmission of a communication over and electronic communications network; or
- the cookie is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
The Working Party indicates that this second exemption should focus on the individual functionality requested by the user – rather than the overall service (which may include functions provided purely for convenience e.g. the ability to leave comments on an article). This exemption effectively becomes a test of whether a particular function would not be available without the relevant cookie, and whether the user has explicitly requested that function.
While this may, initially, seem to limit the scope of cookies that could be covered by the exemption (i.e. on the basis of an argument that the user has accessed the website, so has requested all the functions of that website), it is likely that website operators will see this a benefit from this approach as some cookies which has previously appeared to require consent will fall within this exemption. Looking at some the examples the Working Party sets out is probably the best way of demonstrating this.
While it was generally accepted that cookies for ‘shopping basket’ functionality would fall within this exemption, the Working Party have indicated that the following would also benefit from the exemption:
- multimedia player cookies (or “flash cookies”) where the user visits a website containing text and video contents as these are part of the service explicitly requested by the user;
- cookies necessary for customisation such as a language preference for a particular website or display preferences; and
- social network content sharing cookies for users who are “logged in” to the relevant social network.
There are, however, some conditions attached to this exemption. The Working Party only expects this exemption to apply to single purpose, session cookies. It believes the reasonable expectations of the user would be that such choices or preferences would not extend beyond a single session. Persistent cookies for these functions are therefore still likely to require consent, as will any cookies which have purposes beyond simply providing the relevant functionality. Expect to see a greater deployment of single purpose cookies.
Otherwise, the opinion is a usefully clear view with indications of how cookies such as load balancing cookies and advertising cookies should be treated. And clarifies that all analytics cookies will require consent – although it holds out hope that this will change in the future.
A very useful read for all those still undertaking their good work towards compliance.