Create a Compliant
Cookie Banner

What is a cookie?

The basic definition of a cookie is that it is a small technological file that can be saved on a computer. The file then records and tracks the activity of the user. It is downloaded on the ‘terminal equipment’ (e.g. a computer or smartphone) to be exact. The file can be sent to the user once the user uses or lands on a web page or they open an app.

This is critical for the privacy and security of the user because it allows the website to recognise that user’s device and store some information about the user’s preferences or past actions.

What are the compliance requirements?

The two main regulatory frameworks in place for cookie protection are the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The GDPR is broadly applicable in the UK and the EU. Whereas the CCPA is applicable in the US. Both frameworks also serve as a guideline for several other international laws and legislations surrounding international cookie use. The rules on cookies are covered in regulation 6 of the GDPR to be exact.

The basic rule is that you must:

• tell people that the cookies are there;
• explain what the cookies are doing and why and;
• get the person’s consent to store cookies on their device.

The user should be able to set cookie preferences the first time they visit. Users may get different cookies on various devices that they own. The data may be used by different data processors and that too is required by the law to be first outlined and defined by the cookie owner. If there is likely to be more than one use case, then a clearer and more detailed cookie consent will be required outlining all possible uses of the user’s data.

What is consent?

This is a very tricky question for many courts and businesses. However, in the simplest form of the word, the word entails the permission required before you do something to another person. This also refers to the activity that you perform as a business, or an organisation engages in with another user based on their activity or information provided to you. Hence, consent for the cookies is the permission required before you can implement or use them.

You may also need to obtain fresh consent if your use of cookies changes over time. But, more on that later.

What other legal factors influence the cookie consent policy and your choice of solution?

Another legal framework referred to as the Privacy and Electronic Communications Regulation (PECR) does not set out exactly what information you must provide or how to provide it. It leaves a lot to the owner of the business or you. The only requirement is that it must be “clear and comprehensive” information about your purposes. Users must be able to understand the potential consequences of allowing cookies.

What is good quality consent?

To be valid, consent must be freely given, specific and informed. It must be extracted out of positive action rather than an indicative one. The consent should be clear and not subtle or imagined.

Other relevant information and guidelines:

There is some disagreement among jurors from around the world though, based on different regions. In some places, consent does not necessarily have to be explicit consent. However, consent must be given by a clear positive action. Furthermore, users should be offered the choice to enable or disable non-essential cookies at any point in time. And any website should make this easy to do.