The 9 January will expire the adjustment period to the new guidelines on cookies introduced by the Guarantor for the protection of personal data (Privacy Guarantor) with the last measure June 10. The Authority returned to dealing with the issue seven years after the previous intervention, prompted by the entry into force of the European Regulation for the protection of personal data ( GDPR ), by the dissemination of tracers particularly invasive, but also by the need to make the legal rules relating to the use of cookies more consistent with new technologies. Before seeing what has changed and what are the most novel elements, it seems appropriate to briefly illustrate what cookies are .
When we talk about cookies , we refer to packets – or more precisely text strings – that browsers store on the device (such as computers, smartphones , tablet) of the user while browsing the Internet. The cookies can be used to perform marketing and advertising activities, taking into account that they have the function of memorize users' browsing searches or identify those who have already visited the site previously. Taking into account the potential implications on privacy, the reason why the European Union and the Privacy Guarantor have intervened to regulate their use, so as to avoid abuse and repercussions on the end user, is explained. As highlighted by the same Authority, the GDPR and the European directive cd ePrivacy , implemented in Italy by the privacy code .
The Privacy Guarantor has divided cookies into two categories:
- Cookies first party : they belong to the owner of the application and the data collected by the user are accessible only by the owner;
- Third-party cookies : they belong to external suppliers and the owner has no control over these data, as they are transferred to another domain and to another server. A typical example of third-party cookies are anaylitcs cookies, as is the case with Google Analtycs.
Depending on the purpose, the cookies can then be further divided into two macro-categories:
- Technical cookies : they are intended to facilitate user navigation, by storing some information such as access data, products placed in the cart on a specific e-commerce site. Among the data that can be stored we find personal information (such as the IP address, user name, email address) and information that is not strictly personal (including the settings of the language used, information on the type of device through which you browse. Internet). It is in fact a type of cookies which are used to provide, for example, a communication service and as such the data controller will only have to inform users of their use;
- Profiling cookies : they allow to send the user targeted advertising based on the behavior of the latter in the your previous browsing sessions. The user is in fact grouped within specific clusters of profiles, more or less wide, which allow the owner to provide personalized services in line with user preferences. This type of cookie certainly has more impact on the user's position and it is for this reason that the Guarantor makes the use by the data controller subject to the prior collection of informed consent.
With the new provision of 10 June, which in fact replaces the previous guidelines of 2014, the Authority wanted to strengthen the decision-making power of users regarding the use of personal data while browsing on the Internet. The Privacy Guarantor then confirmed the categorization between technical cookies and profiling cookies : for the former, consent is not required, while for the latter it is essential to obtaining the user's consent. However, the Authority recommended using the analytics cookies for statistical purposes only.
And here comes one of the first important innovations: the non-comparability of scrolling – that is to say the simple movement of the mouse or finger on a touch screen – with the informed consent . According to the notice of the Guarantor, scrolling can never be equated with informed consent, assuming that the user must express his will to accept the processing of his data in a free, unequivocal, specific and informed way. Scrolling, that is, is not suitable for expressing user acceptance of the placement of cookies within their device. The only exception, verifiable case by case but in fact very tortuous and hardly provable in practice, is that the owner demonstrates that the scrolling is the result of an unequivocal and documentable choice of the user.
In the same way, the use of the so-called cookie wall is illegal, meaning that system through which the user must necessarily express his consent to the processing in order to continue browsing the website. . Even in this case, it is a practice that is ill-suited to the need to guarantee the protection of the decision-making power of users.
For the acquisition of informed consent, the Guarantor confirmed the information model already in use, providing that upon the first access to the website, the user displays an area or a banner with specific indications on positioning, dimensions, characters – so as to guarantee easy consultation, a discontinuity with the contents of the page you are visiting, but also to avoid the risk of making unwanted or unaware choices – containing an X selectable at the top right and a link to direct you to read the complete privacy policy . Closing the banner using the appropriate X will result in the remaining of the default settings : in this case, the data controller will have to record the user's decision and will not be able to re-submit the request for treatment. This is because, according to the notice of the Guarantor, the repetition of the banner is capable of affecting the formation of the user's free choice.
Once preferences have been expressed, the request for consent to cookies can only be re-proposed after six months , unless one of the following situations has emerged in the meantime :
- Significant change in processing conditions
- Inability for the manager to keep track of the user's choice
The user always has the right to revoke the consent previously given at any time through a specific area to be placed in the footer of the site.
