European data privacy law distinguishes between session cookies that, for example, allow a website to function properly, and behavioural advertising cookies that are unnecessary for the functioning of the website. With respect to behavioural cookies, recent guidance from the United Kingdom’s Information Commissioner’s Office indicates that consent is required prior to the deployment of behavioural advertising cookies on a website. Specifically, the guidance states “[i]f your service includes cookies used for the purposes of online advertising, you cannot rely on the strictly necessary exemption. Online advertising cookies are not exempt from PECR’s consent requirements and never have been. This includes all third-party cookies used in online advertising, including for purposes such as frequency capping, ad affiliation, click fraud detection, market research, product improvement, debugging and any other purpose.”1

This means that the data subject perform a “clear affirmative act” to evidence their consent.2 For example, checking an unchecked box would constitute a clear affirmative act.3 By contrast, it is not permissible to use pre-checked boxes or simply inform users that the deployment of the cookies is a condition of utilizing the website.4