Is my cookie banner legal? It might not be.

Is my cookie banner legal?

Do you just accept cookies without thinking, or do you look to opt-out, or perhaps you prefer to delve deeper and select which cookies you allow a website to serve to you?

All of these options should be available to you if you are visiting a website that comes under the jurisdiction of PECR (Privacy and Electronic Communication Regulations) which runs alongside the UK and EU GDPR. There should be a cookie banner that is visible immediately that you land on a website, and that cookie banner must give you all of these options. Opt-in, Opt-out, adjust my preference. Under the legislation, it must be as easy to opt-out of cookies, as it is to opt-in to them.

Due to the ongoing privacy campaigning by Max Schrems of the organisation NOYB (none of your business), many organisations are now asking themselves, even though I have a cookie banner on my website, is it enough? Is my cookie banner legal?

First things first, what is a cookie, and what has it got to do with privacy?

Very briefly, and without the need to go into technical detail:

“A cookie is a small file of letters and numbers that is downloaded onto your computer when you visit a website. Cookies are used by many websites and can do a number of things, eg remembering your preferences, recording what you have put in your shopping basket, and counting the number of people looking at a website.” Source ICO

Cookies track and record your online behaviour. They allow a company to track what you have been doing, and they allow this information to be used at a later date, for example for marketing purposes. It is also cookies that enable websites to ‘remember’ your preferences and so on.

What is Max Schrems complaining against?

Last month, The Privacy Group NOYB lodged 226 complaints against ‘deceptive cookie banners’. They have a particular issue with the cookie compliance company ‘One Trust’, which NOYB says, sold cookie banners that did not comply with legal requirements. The complaints against One Trust began back in May 2021 and since that time One Trust has adapted its settings, however, NOYB say that there are still many companies out there whose websites don’t comply.

The issue is ‘deceptive cookie banner design’ says Ala Krinicyte, Data Protection Lawyer at NOYB. The legislation ‘requires a fair yes/no choice [as to whether you will accept cookies], not crazy click-marathons’. Source NOYB

What course of action should I take if I have a website?

If you have a website, firstly, find out if you use non-essential cookies. Even Google Analytics uses non-essential cookies, so the answer is probably ‘yes’, but find out for certain.

If you do use non-essential cookies, you must have a cookie banner that allows users to EASILY opt in or out in one click, with an additional option to view your cookie policy. More sophisticated cookie banner software will also allow people to opt in or out of various different types of cookies. However, the essential thing is, as stated above – there should be a very clear yes or no choice that can be made with just one click – WHETHER YOU OPT IN, OR OPT OUT OF COOKIES.

I use One Trust for my cookie banners, should I panic?

No need to panic. Check what you have in place. One Trust has changed how they do things now, but any longstanding banners could still be an issue. NOYB says they have contacted all parties they believe to be involved and given them an option to put things right. This latest tranche of complaints is against organisations refusing to correct their banner or remove their cookies.

For your peace of mind, use this graphic as a guide, and if you are unsure, please contact us here at the Griffin House Consultancy. Use your complimentary thirty-minute consultation and we will be able to provide you with advice and guidance. You can book your consultation here.