COOKIE ACT

Cookie Act: obligations for whom?
For everyone who owns a website. But also for everyone who places a cookie on peripherals (computer, tablet, smart phone.

Obligations under the Cookie Act
The main new obligations included an information obligation and a permission obligation. These are inextricably linked. Without providing proper information, no legal access can be obtained.
Users of cookies (except for functional cookies) have to inform the website visitor about the purposes for which the website wishes to store data or wants access to data prior to the installation of cookies (regardless of whether the website does this or a third party). In other words: why is a cookie used and what happens with the information gathered by a cookie.

Subsequently, users of cookies should ask permission for the use of cookies. This permission should be a free, specific expression of a wish, based on information.

There has been a lot of discussion about how to comply with both obligations.

Position of OPTA
The OPTA - the enforcing agency - recently publisher her position on the way she believes the aforementioned obligations are complied with.

Information duty:

• Should be placed on a visible location on the website, with a comprehensible explanation or the reason and purposes of the installation of cookies;
• Information provision cannot be a vague referral to a privacy statement. This may be used to refer to individual cookies in detail and may also be used to meet the requirements from the Data Protection Act;
• If third party cookies are placed through the website visited, then:
  • these third parties should be identified. "Partners carefully selected by us" does not constitute sufficient identification. It should at least be identified what third parties of or categories of third parties it concerns (such as travel insurances) and
  • it should be indicated why the website allows the cookies and that the third parties may also use the cookies for other purposes (such as profiling). A referral to the third party conditions is more advisable than copying these conditions to one's own website.

Permission duty:
It is not enough to obtain so-called implied consent. An active action of the website visitor is required to be able to speak of legal consent (for instance checking a box, clicking a selection button). The permission should then be logged to be able to serve as evidence in complaints.

Concrete for you
The method of asking permission currently used and often recommended does not suffice. In the pop-up, floating box, info bar or overlay, too little and ambiguous information is provided, Providing correct, clearly described information is essential for obtaining legal permission.

Cookie Act Exceptions
The Cookie Act does not apply to functional cookies. These are cookies that are necessary for the proper performance of the website (for instance for remembering password, language setting or shopping cart preferences). In addition the OPTA and the CBP will not enforce the "reversible evidence suspicion" that the use of tracking cookies constitutes processing of personal information in the sense of the Data Protection Act until January 1^st 2013. Until then the industry is granted a grace period to find a suitable solution for obtaining permission to use tracking cookies. The currently existing solution to obtain permission through the browser setting, is considered to be inadequate.

Perhaps superfluously: The OPTA is working on a tool with which the cookie use of websites can automatically be checked. The OPTA is authorized to fine up to EURO 450.000,00.