knowledge 2 October 2020 |

Cookies and Compliance: Approaching Deadline for Controllers to Audit Their Use of Cookies and Tracking Technologies

In line with its renewed focus on organisations’ use of cookies and other tracking technologies, in April 2020, the DPC published detailed guidance for controllers on the lawful use of these tools (the “Guidance Note”). Our briefing of 5 May 2020 highlights the key takeaways from this Guidance Note and the DPC’s Report on the compliance issues arising from its survey on the use of cookies by a selection of websites across a wide range of sectors.

The Guidance Note requires organisations to align their cookies and other tracking technology practices – such as social-media sharing tools – with applicable laws. In particular, the Guidance Note draws on the Planet49¹ judgment of the Court of Justice of the European Union and makes it clear that the use of pre-checked boxes to gather consents to the use of cookies is not an acceptable practice.  For most organisations, compliance with the guidance will require an update to their cookies policy and the implementation of a cookies management tool.

The DPC set a 6-month-period within which organisations were expected to review their existing tracking practices and, where necessary, update these to bring them into compliance with the law. This grace period expires on 5 October 2020, post which it is expected that the DPC will respond to non-compliance with regulatory enforcement action.