Search engines, social media websites and providers of online messaging services in the European Union (EU) would be required to obtain opt-in consent before using individual data to deliver targeted advertising under proposed rules unveiled by the European Commission (EC) on Tuesday.

The draft EC regulation would extend to web companies rules that currently apply to telecommunications operators under the EC’s “EPrivacy” directive. Asserting that 80% of EU citizens support tools that limit the use of browser cookies and other data used for advertising purposes, the EC said web firms would be required to obtain affirmative consumer consent to the use of tracking cookies when a user installs a web browser, or when they install software or sign up for any service that permits electronic communications. The proposed rules would also replace an existing EC directive that requires web sites to offer a pop-up banner on their home page through which users can grant consent to the use of tracking cookies. EC sources also confirm that the draft rules would take precedence over any individual consent granted to affected providers under privacy policy agreements. Violators could face fines of up to four percent of their global revenues. 

Members of the European Parliament and each of the EU member states must ratify the proposal, and EU officials hope the regulation will be adopted by May 2018 when other data protection rules go into effect. Stressing the importance of transparency, an EC spokesman said “people must know whether information stored in their devices is being accesses or whether their online behavior is tracked.” Advocates of online firms warned, however, that the rules could negatively impact many online providers that offer service for free but depend on advertising to fund themselves.