The Dutch data protection authority (‘AP’) released, on 7 March 2019, guidance (‘the Guidance’) on the use of tracking cookies. In particular, the AP highlighted that websites that only allow visitors access if they agree to tracking cookies are violating the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) and noted that for the use of tracking cookies, tracking software, or other digital tracking methods, organisations must seek consent.
Wouter Seinen, Partner at Baker & McKenzie Amsterdam N.V., told DataGuidance, ”The Guidance has a significant impact on websites […] where cookie walls are being used more frequently. However, the real impact is on apps and games that require certain permissions or consent to be given as a precondition for activating the app. This strategy is broadly used to get permission for push messages and the collection of location data. Application of the AP’s new ‘doctrine’ to these market players would have major consequences.”
The Guidance outlines, among other things, that the practice of using cookie walls, which restrict website access if cookies are not accepted by the user, is contrary to the GDPR as consent is not freely given. Furthermore, the Guidance clarifies that consent cannot be considered to be freely given if individuals are prevented from having a real choice, or if refusal would lead to adverse consequences.
The Guidance has not been tested in court and it remains to be seen how courts will view this, rather aggressive, position of the AP
Seinen continued, ”Opt-in consent for unsolicited commercial messages is another area which was traditionally not enforced by the AP, but may well fit with the AP’s agenda going forward. Businesses that may be impacted include those that collect email addresses and opt-in for unsolicited messages in exchange for providing publications, white papers, or other content. Opt-in consent obtained through this model is now jeopardised by the Guidance.”
In addition, the Guidance outlines that organisations using cookies are now tasked with adapting their practices where necessary. It also highlights that the AP plans to intensify its monitoring to ensure that the standard established by the Guidance is being applied correctly in the interest of protecting privacy.
Seinen concluded, ”The Guidance has not been tested in court and it remains to be seen how courts will view this, rather aggressive, position of the AP. The Dutch government has previously embraced the principle of freedom to contract and clearly stated that allowing access to content may be offered on the condition that consent is given. We would love to have the Dutch courts to look into this.”
WERONIKA NATALIA BŁASZCZYK Privacy Analyst