Now, the Article 29 Working Party has provided guidance intended to set forth requirements to make a website legally compliant across all Member States. This guidance has four elements:\
- Specific Information: Consent must be specific and based on appropriate information. The Guidance makes clear that notice should be “clear, comprehensive, and visible” at the time and place where consent is sought, such as the website’s homepage. Information must include the purpose(s) of the cookies and, if relevant, details about third party cookies used on the site. Also, the cookie expiration date and any choice mechanism must be explained.
- Timing: By law, consent must be given before cookies are set or read.
- Real Choice—Freely Given Consent: Users must have the opportunity to freely choose to accept or decline some or all cookies. Granularity in choice is recommended, and the Guidance recommends that websites refrain from using consent mechanisms that only provide an option to consent without further choice. This choice should extend to “tracking cookies,” used for online behavioral advertising, and the website should obtain “unambiguous consent” to this type of cookie.