Ikea, Twitter, Google, Amazon, Vueling… These are examples of some companies that have received sanctions in less than a year for not having the cookie policy of their website in accordance with legal regulations.
Cookies are essential elements for the functioning of the Internet, as they allow websites to operate properly, know the preferences of visitors and be able to offer their products or services in a personalized way, taking sensitive data such as the device’s IP, location, demographic information and even passwords and credit card numbers.
In order to protect this data and the rights of website visitors, two fundamental obligations were imposed on online service providers in 2012: to inform about their own and third-party cookies, and to ask for permission before installing them . Consent (based on the European Data Protection Regulation) had to be express, free and unequivocal.
But this is no longer enough. Since 31 October , websites must adapt to the new requirements of the European Data Protection Board (EDPB) , based on the principles that users must always be informed of what data is collected and can decide which of these data they want to provide.
What are the new requirements?
Changes related to revocation of consent
The banner or pop-up informing about cookies must offer three options:
- Reject cookies
- Accept cookies
- Configure cookies
In this way, the user will be able to decide which cookies the website provides.
Remove the option to request consent via “continue browsing”
From now on, the option to “continue browsing” is in no way a valid way of providing consent.
The prohibition of the use of cookies wall except in certain situations
Until now, it was possible to limit access to certain areas of the website to users who refused the use of cookies; under the new regulations, this is no longer possible except in the following cases:
- The user is adequately informed
- An alternative access to the service is offered without the need to accept the use of cookies as long as it is equivalent to the original, and is not offered by an external entity.
And if I don’t adapt my website, what can happen?
Failure to comply with the regulations may result in fines ranging from €30,000 to €600,000.
Do you already have your website ready?