The European Union (EU) Article 29 Working Party recently released an opinion setting forth “practical” guidance for obtaining consent to the use of cookies or similar technologies across the EU. 4 The amended 2002 ePrivacy Directive, adopted in 2009, required all EU Member States to implement a local law mandating that websites obtain consent prior to placing cookies or other technologies on a user’s device. Member States slowly passed these local laws over the past few years, resulting in a range of different obligations for websites operating across the EU.

Now, the Article 29 Working Party has provided guidance intended to set forth requirements to make a website legally compliant across all Member States. This guidance has four elements:\

  1. Specific Information: Consent must be specific and based on appropriate information. The Guidance makes clear that notice should be “clear, comprehensive, and visible” at the time and place where consent is sought, such as the website’s homepage. Information must include the purpose(s) of the cookies and, if relevant, details about third party cookies used on the site. Also, the cookie expiration date and any choice mechanism must be explained.
  2. Timing: By law, consent must be given before cookies are set or read.
  3. Active Behavior: Websites must present clear and comprehensive information to users on how they may signify consent. This should appear on the page where users start their browsing experience. Different tools to obtain consent could include “splash screens, banners, modal dialog boxes, browser settings etc.” Browser settings are appropriate where the website operator is “confident” that the user is fully informed and has actively configured their browser in response. The Guidance also supports use of a positive action or active behavior, such as clicking a button or link, or ticking a box. The Guidance makes clear that any user who enters a website and is shown information on cookies, but does not undertake an active behavior, has likely not consented to the use of cookies.
  4. Real Choice—Freely Given Consent: Users must have the opportunity to freely choose to accept or decline some           or all cookies. Granularity in choice is recommended,  and  the  Guidance  recommends  that websites refrain from using consent mechanisms that only provide an option to consent without further choice. This choice should extend to “tracking cookies,” used for online behavioral advertising, and the website should obtain “unambiguous consent” to this type of cookie.