The cardinal sin of owners of websites is suggesting in the popup that further use of the website means consent to use or installation by the website of types of cookies that under applicable law can be installed on a user’s device only with the user’s consent. These cookies include primarily marketing and remarketing cookies (but also functional and statistical cookies), as well as third-party cookies, such as Google Analytics. It is essential to use technical solutions that install cookies on the user’s computer or other device only after the user consents to receive the cookies. It is clear that the user’s passivity, specifically continuing to use the site, cannot be deemed to provide such consent. The law does not require consent to install files essential to the functioning of the site, but marketing cookies, Google Analytics or a Facebook pixel cannot be regarded as necessary cookies.
This view is hardly controversial, and thus it is surprising how widespread it is for cookies to be installed despite the lack of user consent. The reasons for this state of affairs must give pause. They seem to arise from a belief that in practice, regardless of what the regulations say, installing cookies without the required consent of users cannot have negative consequences for the owner of the site. Many owners of websites take the view that the matter is so trivial that it will not attract the interest of supervisory authorities.
How the issue of obtaining consent to installation of cookies is regulated may change in the future in connection with adoption of the EU’s proposed ePrivacy Regulation. It is not known when work on the regulation will be completed or what solution will ultimately be adopted. One of the premises of the work on this act is to create a regulation that is convenient to end users, who now often regard consenting to installation of cookies as a nuisance. But until the new rules in this area are known, it would be prudent to follow the guidelines presented above.
Katarzyna Szczudlik, adwokat, New Technologies practice, Wardyński & Partners