From personal information to adapting online platforms: here are the new guidelines on the use of cookies on websites.
One of the most important regulations issued in July 2021 by the Privacy Authority concerns user information, which can only be used after receiving the user’s explicit consent. Another major recommendation is on themandatory retrofitting of platforms: it must be done by January 10, 2022.
It will also be necessary to arrange in the cookie acceptance banner the buttons of ‘Reject’ or ‘Accept’ and, at the same time, the user must have the possibility – at any time – to change the consent of previously accepted personal or analytical data.
Stop cookie wall and scrolling
Guarantor considers cookie walls unlawful. They are the ones who block site navigation to users who do not agree to the use of cookies, and, therefore, the use of the sites will have to be allowed in an equivalent manner to those who do not agree to the use of their data.
Stop so-called scrolling, the scrolling action that a user performs on a web platform’s homepage, which will no longer be considered valid under the new guidelines as tacit consent to use their cookies. An additional guideline on this topic has a time reference: consent cannot be requested until 6 months have passed since the last time the user has agreed to the use of cookies.
The statistical cookies first-party and third-party
First-party and third-party statistical cookies can be installed without the user’s consent. In this case, however, some clarifications must be made:
- first-party statistical cookies, first of all, are used by the website owner who directly monitors users’ movements on their platform for statistical purposes;
- third-party statistical cookies use other external statistical tracking platforms such as Google Analytics.
For the former, the Privacy Authority does not require installation by consent from users to monitor their movements, so the site owner can use freely collected statistical cookies.
For the latter, however, no matter how free the owner’s use is, it is still limited by certain conditions:
- identification of a user by storing his/her personal data (e.g., through abbreviated IP addresses, assigned not to a single device, but to several) is not allowed;
- their use is limited to a single site/app, so the same data cannot be used by other platforms;
- Should not be shared or disclosed to third parties;
- data collected should not be combined with other data.
In the new guidelines on the use of cookies , the possibility of concrete proof of consent that has taken place from the user is required, according to the GDPR (the General Data Protection Regulation). Although the Privacy Guarantor does not indicate an obligation to have a “consent register” of all users who agree to the site’s use of data, personal data protected by the GDPR are also recorded, so Italian websites being in Europe must comply with the provisions of the European Data Protection Regulation.
Finally, there are cookies necessary for the optimal use of the site, to improve user experience or communication of the site itself, which do not need consent. It is important to note that the owner’s interest is not a valid legal basis for using users’ cookies deliberately.
