The Ordinance requires data controllers to obtain prior opt-in consent from subscribers or users of electronic communication services before installing cookies on users’ computers or other equipment. Prior opt-in consent is not required if the cookies will be used to facilitate online communication or are necessary to provide an online service. Before obtaining prior opt-in consent, data controllers also must inform individuals about how the cookies will be used and how a person may opt out after giving consent.
The Ordinance specifies that opt-in consent for cookies may be obtained via user-controlled settings on the relevant device. This implies that user consent may be inferred from web browser settings that allow cookies to be installed on a computer.