Cookie Banner Taskforce publishes draft report
31st January 2023
Cookie Banner Taskforce publishes draft report
When a ‘taskforce’ is involved, you get the impression that the EDPB (European Data Protection Board) is taking the matter seriously. This means that you should too. The matter the Taskforce has been investigating is cookie banners.
Why is there a cookie banner taskforce?
The EDPB Taskforce was put together as a response to the questions and complaints made by noyb (which stands for ‘None of Your Business’), the privacy campaign NGO founded by Max Schrems.
During a 15-month period between May 2021 and August 2022, having trawled the internet for culprits of non-compliance, noyb made over 700 complaints to data protection authorities across Europe about the design of cookie banners – particularly the fact that many of them are, in their opinion, deceptive.
As we discussed in our blog in September, noyb is saying that there are still a huge number of websites that are not complying with cookie banner legislation.
Due to the scale of the complaints across the European region, the EDPB Taskforce was created to allow for a coordinated response and the sharing of best practice.
What has the cookie banner taskforce published?
At the moment, the report published on 18th January 2023 is in the draft stage and you can read the Cookie Banner Taskforce report in full here. However, in summary, it does largely agree with and support noyb’s complaints.
NOYB certainly seem pleased with their progress, stating in their response to the publication of the report:
“If implemented, this report could ensure minimum requirements for cookie banners . . . the worse cases should soon be gone.” noyb
According to noyb, the draft report agrees with them that the following common practices are unlawful under EU law:
- No reject option on the first layer (but hidden in a sub-layer)
- Pre-ticked boxes instead of active consent
- Tiny links in another text to refuse consent
- Links outside the cookie banner to refuse consent
- Claiming legitimate interest for installing non-essential cookies (and not asking for consent)
- Not offering a permanent option to withdraw consent
Source: noyb
In fact, the report goes so far as to suggest that this is the ‘minimum threshold’. They are not saying that if you are correctly following all of the above that you are fully lawful, it is not quite as simple as that.
The EDPB also state in the draft report that best practice is that:
- Website owners should easily accessible solutions in place put in place, allowing users to withdraw their consent at any time, such as an icon (a small hovering and permanently visible icon) or a link placed in a visible and standardized place.
What happens now?
This is your advance warning. Have a look at your cookie banner. How does it display? Are you guilty of any of the common practices referred to above? If so, GET IT CHANGED.
Also, be aware of the colour of your consent / non-consent boxes. Whilst the Taskforce were a little less blatant about their agreement with noyb on this one, they are still saying that if you try and make it more difficult to see the opt-out button, than the opt-in button – you are in breach of the legislation.
The image attached to this article is how the European Data Protection Board themselves present their cookie banner so perhaps model yours on that one? Alternatively, take a look at our previous blog on the subject here, or for a more robust look into the use of cookies, take a look at the guidance from the ICO here.
If you would like some help on the matter of cookie banners and consent, please do take advantage of your complimentary thirty-minute consultation with one of our data protection specialists: peace of mind is just a phone call (or a Teams call!) away.
