As many readers will be aware, a key enforcement trend in the privacy sphere is the increasing scrutiny by regulators and activists of cookie banners and the use of cookies. This is a topic that we have been tracking on the Inside Privacy blog for some time. Italian and German data protection authorities have issued guidance within the past three months, adding to guidance coming out of France,  Spain, the UK and at EU level from the EDPB. The EDPB has also recently adopted guidance on the use of “dark patterns” in social media interfaces, setting out best practice to ensure that users can make fully informed decisions. The key compliance recommendations relating to cookies set out by these various guidelines include:

  • allowing only essential technical cookies to be implemented by default, and requiring user consent for all other cookies that are merely helpful or convenient;
  • the need for the giving of consent to non-essential cookies be a clear and positive action, rather than being given, for example, by way of a pre-ticked box or by continued use of a site;
  • preventing consent bundling whereby consent is given in one click for cookies used for more than one purpose without granular controls; and
  • making the withdrawal of consent to cookies as easy as giving consent.

Alongside this increasing prevalence of regulatory guidance on cookies, there has been a wave of letters from activists to companies pointing out apparent shortcomings in compliance, and a corresponding increase in the submission of complaints to national data protection authorities across Europe. Notably, noyb recently sent a second wave of two hundred and seventy draft cookie banner complaints to website operators across Europe. This follows from the initial batch of over five hundred letters sent by the same organisation in May 2021.

Complaints from activist groups such as noyb have focused on the following practices by website operators:

  • inaccurately classifying certain cookies as “essential”;
  • using pre-ticked boxes to obtain consent for cookies;
  • making accepting cookies easier than rejecting them when first landing on a site through design features, such as the use of different colours and levels of contrast;
  • situating the options to accept and reject cookies on different layers of a cookie pop-up;
  • allowing users to reject cookies only via links to separate webpages, rather than utilising an integrated reject button; and
  • making the withdrawal of consent to cookies more difficult than the original giving of that consent.

As can be seen, both regulators and activists have very similar data privacy concerns when it comes to cookies and cookie banners, notably honing in on the need for cookie banners and pop-ups to be designed in such a way that website users are able to make a free and informed choice between consenting to and rejecting cookies.

Throughout this period of increased scrutiny on cookies, Covington’s multi-jurisdictional Data Privacy and Cybersecurity team has been actively assisting clients to navigate the various guidelines and to respond to letters from activists, and is ideally placed to help with any questions you may have.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Photo of Paul Maynard Paul Maynard

Paul Maynard is an associate in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online…

Paul Maynard is an associate in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online platforms. He also advises clients on how to respond to law enforcement demands, particularly where such demands are made across borders.

Paul advises emerging and established companies in various sectors, including online retail, software and education technology. His practice covers advice on new legislative proposals, for example on e-privacy and cross-border law enforcement access to data; advice on existing but rapidly-changing rules, such the GDPR and cross-border data transfer rules; and on regulatory investigations in cases of alleged non-compliance, including in relation to online advertising and cybersecurity.

Tomos Griffiths

Tomos Griffiths is a Trainee who attended Durham University