The Italian data protection authority ('Garante') released, on 10 July 2021, guidelines on cookies which aim to protect user's personal data when browsing online. Specifically, the guidelines aim to ensure website owners comply with both the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) ('ePrivacy Directive').

In particular, in regard to profiling cookies, the guidelines highlight that consent must be requested through a clearly distinguishable banner, through which users must also be offered the possibility to continue browsing without being tracked in any way. Furthermore, the guidelines clarify that simply scrolling down the web page does not constitute consent, and in any case the user should have the right to withdraw consent at any time. Moreover, the guidelines further specify that information provided to users must also indicate any other recipients of personal data and the time period for which their data will be retained. In addition, the guidelines confirm that such information can be given in different formats, such as through videos or pop-ups.

Going forward, the guidelines note that the Garante aims to have a universally accepted code for use of cookies in the future. Finally, the guidelines confirm that website owners have six months to comply with these new principles regarding the use of cookies.

You can read the press release here and the guidance here, both only available in Italian.

UPDATE (4 August 2021)

Garante updates FAQs on cookies

The Garante announced on Twitter, on 30 July 2021, that it had updated its cookie FAQs in line with the new cookie guidelines.

You can read the cookie FAQs, only available in Italian, here.