Cookie Compliance Considerations
Cookie Compliance Considerations
A. European Union (“EU”) and United Kingdom (“UK”)
1. EU/UK Cookie Compliance Requirements
Legislation implementing the ePrivacy Directive 2002/58/EC (“ePrivacy Directive”) is commonly understood as the main law regulating the use of cookies in the European Economic Area (the European Union plus Iceland, Liechtenstein and Norway) and the UK. The ePrivacy Directive applies at an EU level as a Directive but is implemented on a national level (and in the UK) via various local laws.
Laws implementing the ePrivacy Directive in each EU member state and the UK require organizations to:
- Say what automatic data collection technologies will be set on its website(s) (such technologies referred to herein as “Website Trackers”);
- Explain what these Website Trackers will do; and
- Obtain prior informed consent for the use of Website Trackers, other than for Website Trackers that are strictly necessary to provide a service or functionality requested by the user (e.g., using a cookie that remembers the items a user has put in their shopping cart as they navigate the website).
Note: Strictly necessary cookies must be those objectively necessary for website function – such cookies cannot merely be helpful or convenient.
2. EU / UK Cookie Banner Language
Implementation
- Display the banner upon the visitor’s arrival to the site from a non-U.S. IP address.
- Display the banner in such a way that the visitor is likely to interact with it prior to using the site (e.g., presenting the banner in a “floating” design that obstructs a portion of the site, such as the lower right-hand quarter).
- Design the banner so it only disappears after a user makes a choice about cookies (e.g., do not provide an “X”).
- Do not fire non-essential / non-necessary cookies or other trackers until the visitor has opted-in (via the “Accept All Cookies” button or the toggles on the Cookie Preference Manager).
- Set the visitor’s consent to expire after a period of time, so they are presented the cookie banner the next time they return to the site (e.g., at least once per year, though some regulators prefer to see this once every 6 months).
3. EU / UK Cookie Preference Manager Language
Implementation
- The manager should be accessible from the “Manage Preferences” link in the cookie banner, a “Cookie Settings” link in the footer of the website, and any hyperlinks included in the Privacy Notice.
- When the visitor clicks the drop-down for one of the cookie categories, the following language should be displayed:
B. United States
1. California Consumer Privacy Act (“CCPA”) and Similar Cookie Compliance Requirements
The CCPA and other state privacy laws provide residents of their respective states with the right to direct businesses not to “sell” the consumer’s personal information, or “share” / “process” the consumer’s personal information for cross-context behavioral or targeted advertising purposes. This means consumers must be given the option to opt-out of such information sharing directly on the business’s website, such as through the use of a preference manager that allows the consumer to turn OFF Website Trackers that involve the sharing of personal information with third parties (i.e., through a toggle that opts consumers out) in addition to other opt-out mechanisms for “sales” / “targeted advertising” occurring through other channels. Notably, under the CCPA, businesses must include a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link on their website that allows consumers to submit an opt-out request.
In addition to manually turning off such cookies, certain state privacy laws require businesses to be able to receive and effectuate opt-out requests submitted automatically via opt-out preference signals that are transmitted in a format commonly used and recognized by businesses (such as an HTTP header field or JavaScript object). By way of example, the California Attorney General has expressly stated that this includes the recently launched Global Privacy Control. As a result, a business must ensure that its preference manager or similar tool is capable of automatically detecting and effectuating such signals by turning OFF Website Trackers that involve the sharing of personal information with third parties by default.
Notwithstanding the foregoing, even though a cookie banner is not technically required under such laws (only a preference manager is required), we recommend presenting consumers with a cookie banner catered towards these laws to reduce wiretap litigation risk.
2. U.S. Cookie Banner Language – Opt-Out Language
Implementation
- Display the banner upon the visitor’s arrival to the site from a U.S. IP address.
- Display the banner in such a way that the visitor is likely to interact with it prior to using the site (e.g., presenting the banner in a “floating” design that obstructs a portion of the site, such as the lower right-hand quarter).
- Design the banner so it only disappears after a user makes a choice about cookies (e.g., do not provide an “X”).
- If possible, delay the firing of non-essential / non-necessary cookies or other trackers for a short-period of time (e.g., 10 – 15 seconds, though it can arguably take longer for a website visitor to actually spot and read through the cookie banner, such as 30 seconds) to allow the website visitor to review the banner before the cookies and similar technologies are activated.
- If the website visitor clicks “Decline Non-Necessary” or visits the site with the GPC signal enabled, non-essential / non-necessary cookies and other trackers should be turned OFF. Note: If the Global Privacy Control signal is detected, some companies automatically record the website visitor’s choices and do NOT display the banner or display a custom banner noting the GPC signal was detected and effectuated.
3. U.S. Cookie Preference Manager Language
Implementation
- The manager should be accessible from the “Manage Preferences” link in the cookie banner, a “Cookie Settings” link in the footer of the website, a “Your Privacy Choices” link in the footer of the website, and any hyperlinks included in the Privacy Notice.
- When the visitor clicks the drop-down for one of the cookie categories, the following language should be displayed:
C. Alternative U.S. Cookie Banner Design
As previously discussed, cookie banners are not required by most privacy laws in the United States. However, we have seen an increase in class action litigation targeting the use of non-essential cookies and trackers without appropriate consent. The opt-out banner above is designed to help reduce the risk of such a claim, but there are alternative designs that can be considered.
1. U.S. Cookie Banner Language – Opt-In Language
An opt-in consent banner is the most effective design strategy for reducing class action litigation risk. However, it also has the greatest impact on marketing and analytics effectiveness.
Implementation
- Display the banner upon a visitor’s arrival to the site from a U.S. IP address.
- Display the banner in such a way that the visitor is likely to interact with it prior to using the site (e.g., presenting the banner in a “floating” design that obstructs a portion of the site, such as the lower right-hand quarter).
- Design the banner so it only disappears after a user makes a choice about cookies (e.g., do not provide an “X”).
- Do not fire non-essential / non-necessary cookies or other trackers until the visitor has opted-in (via the “Accept All Cookies” button or the toggles on the Cookie Preference Manager).
▪ Note: If the Global Privacy Control signal is detected, some companies automatically record the website visitor’s choices and do NOT display the banner or display a customer banner noting the GPC signal was detected and effectuated.
2. U.S. Cookie Banner Language – Implied Consent / Notice Only Approach
An implied consent / notice only banner is the least effective design strategy for reducing class action litigation risk. However, it also has the least impact on marketing and analytics effectiveness.
Implementation
- Display the banner upon a visitor’s arrival to the site from a U.S. IP address.
- Display the banner in such a way that the visitor is likely to interact with it prior to using the site (e.g., presenting the banner in a “floating” design that obstructs a portion of the site, such as the lower right-hand quarter).
- If possible, delay the firing of non-essential / non-necessary cookies or other trackers for a short-period of time (e.g., 10 – 15 seconds, though it can arguably take longer for a website visitor to actually spot and read through the cookie banner, such as 30 seconds) to allow the website visitor to review the banner before the cookies and similar technologies are activated.
▪ Note: If the Global Privacy Control signal is detected, non-essential cookies still need to be turned OFF.