Who: The Information Commissioner’s Office (ICO)
Where: United Kingdom
When: 3 July 2019
Law stated as at: 1 August 2019
What happened:
Advertisers and brands will now have to seek GDPR standard consent in order to place non-essential cookies onto a user’s device.
Since the Privacy and Electronic Communications Regulation 2003 (PECR) came into force, consent has been required to place non-essential cookies. “Implied consent” was commonly relied on, often through relevant information being included in a cookie banner, with continued browsing being deemed to constitute consent. Such practices are no longer compliant, following the entry into force of the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, which provide that “consent” under the PECR has the same meaning as consent under the GDPR.
The ICO has now published guidance on how advertisers and brands need to achieve consent to place cookies. The guidance also provides that if the data collected by the cookie is anonymous, the consent requirement still applies because PECR applies to all cookies.
For further information, please see our Insight.
Why this matters:
Advertisers and brands often rely on implied consent for cookies in order to optimise a consumer’s journey through a website. The change in the law means that advertisers and brands will need to consider carefully how to obtain consent and the potential effect this may have on its own targeted advertising activities. In order to obtain valid consent, advertisers and brands now should give users the option to opt-out from non-essential cookies, which means that cookies used for online advertising may not be able to be placed, which could prevent the user being tracked for targeting advertising.
Advertisers and brands should consider revisiting their cookies policies to ensure they do not fall foul of the law and most recent guidance.
