In July 2024, the noyb organization, led by Austrian data protection activist and lawyer Max Schrems, published a detailed report examining the decisions and recommendations issued by national data protection authorities regarding website cookie management. The report reflects on specific points from the European Data Protection Board (EDPB) Cookie Banner Taskforce’s January 2023 recommendations and scrutinizes the practices of national authorities.
As a reminder, the EDPB Cookie Banner Taskforce’s report, adopted on January 17, 2023, addresses various practical issues related to cookie banners, particularly focusing on the ePrivacy Directive and the GDPR. The most commonly observed unlawful practices were listed by the EDPB Taskforce in eight points:
1. No reject button on the first layer:
– Many cookie banners only have an accept button on the first level, with the reject button either absent or not displayed on the first interface.
– The taskforce deemed this as violating the requirement for valid consent.
2. Pre-ticked boxes:
– The use of pre-ticked boxes does not result in valid consent according to the GDPR and the ePrivacy Directive.
3. Deceptive links:
– Some banners offer the reject option as a link rather than a button, which does not provide valid consent.
– Banners must be designed so that users can easily understand what they are consenting to.
4. and 5. Deceptive button colors and contrasts:
– Highlighting accept buttons with colors or contrasts can be misleading.
– Each banner should be individually assessed to ensure colors and contrasts are not misleading users.
6. Claiming legitimate interest:
– Some data controllers cite legitimate interest for certain data processing activities, which can be misleading and unlawful.
– Users should be clearly informed about their options.
– The EDPB notes that data controllers often base their data processing activities, such as “Creating a personalized content profile” or “Selecting personalized ads,” on legitimate interest under Article 6(1)(f) GDPR. However, for such processing activities, no overriding legitimate interest exists. Consequently, the EDPB asserts that legitimate interest cannot be used as a legal basis for advertising purposes. Incorporating the notion of legitimate interest into the further layers of the banners (when users must opt-out of cookies based on legitimate interest in a second window) can be confusing, leading users to believe they must refuse twice to prevent their personal data from being processed.
7. Inaccurately classified “essential” cookies:
– Many data controllers classify cookies as “essential” or “strictly necessary” when they do not meet these criteria. Cookies necessary for the website’s operation or communication with the user do not require user consent. All other cookies do require user consent.
– Regular reviews and audits of cookies are necessary to ensure they are correctly classified as strictly necessary.
8. No option to withdraw consent:
– Data controllers must provide users with an option to withdraw consent, such as through a permanently visible icon at the bottom of the webpage.
– The withdrawal option must be as easily accessible as the consent option.
In 2021, noyb initiated an investigation against websites using unlawful cookie banners. According to noyb, the widespread use of deceptive cookie banners led to “consent banner fatigue”, where users were more likely to accept cookies automatically due to the difficulty or inconvenience of rejecting them.
Noyb’s investigation revealed the prevalent use of “dark patterns” in cookie banners, which are intentionally deceptive design elements aimed at making it difficult to reject cookies. In March 2021, noyb filed over 600 complaints against websites using unlawful banners. These complaints were based on Article 5(3) of the ePrivacy Directive and GDPR requirements, which stipulate that consent must be freely given, informed, and explicit.
Noyb’s mass complaint project aimed to establish consensus on practices violating data protection principles, particularly focusing on widespread issues such as the absence of a reject button and deceptive design. As mentioned above, the EDPB created a task force to coordinate responses to these complaints. However, national data protection authorities may adopt stricter standards than those recommended by the EDPB, which only sets minimum expectations.
Noyb’s report compared the guidelines and decisions of national data protection authorities with the EDPB report findings. Notably, the Hungarian authority, NAIH, is absent from the noyb report, likely due to having only addressed cookie management in only one decision (you may read more about NAIH’s cookie case here).
Summary of the findings from the noyb report:
The full report of the noyb can be read here: https://noyb.eu/sites/default/files/2024-07/noyb_Cookie_Report_2024.pdf