Table of contents
Cookies and their management are currently causing grey hairs in all directions. Most users are likely to be annoyed by constant cookie requests, and website administrators should keep abreast of how to ask for cookie acceptance without getting into trouble.
The main source for the text of this article is Traficom’s Cookie guidelines for service providers, which surprisingly is a pretty heavy package to read, although the page count is not mind-blowing. Hopefully, this writing will give you a step-by-step guide to make things a little easier.
Asking the user about cookies
If your website uses cookies or similar technologies, the website user should be informed. In addition, the user should have the power to choose whether to accept cookies, to refuse all but essential cookies, or to customize what cookies are enabled and disabled.
Many people’s first thought is that a business needs to track users with every pixel and analytics widget in the world. Unfortunately, essential cookies are those without which the site simply won’t technically work, so marketing and analytics cookies are not essential. Necessary cookies may include cookies used to identify the user at login.
Correctly structured cookie query and management
Accepting cookies: how to ask correctly
Users should be asked about cookies as soon as they arrive on the site. The response options should include
- Accept all, i.e. the user accepts all cookies.
- Choice, i.e. the user can easily choose which cookies to accept and which to reject. This is made easier if you break down the cookies, e.g. analytics, marketing, essential, etc.
- Deny all or Only necessary, i.e. the user only accepts the use of cookies that are necessary for the functioning of the site.
These three response options should be offered to the customer on an equal footing. The user should therefore be able to reject cookies as easily as to accept them, and to make their own choice. In practice, there should be three buttons next to each other on the banner from which the desired action is taken.
If the user does not select any, it should be interpreted that all cookies except the essential ones are denied.
On cookie management and editing
The user should be able to see which cookies the site is using and for what purpose.
If necessary, the provider should be able to verify the user’s acceptances, choices or non-acceptances. The user should be able to tell when and what kind of response has been given.
To make things a little harder, the user may change their mind. When a previously given acceptance is to be changed, it should be possible to do so easily, i.e. the cookie banner should magically reappear for those who wish to fill it in again.
The easiest way is to store a cookie (necessary) for the user, which tells the site what the user has responded to and when. The settings can be edited, for example, on a separate cookie description page, which should otherwise be updated whenever there are changes to the cookies.
Legitimate interest does not give permission to store cookies
Many websites talk about a legitimate interest in the cookie banner, a piece of legal jargon that is enough to make you throw up your hands. Despite the nice term, legitimate interest (the legitimate interest of the controller under Article 6(1)(f) of the General Data Protection Regulation) is not a legal basis for using cookies or similar tracking technologies.
Therefore, if you do come across a legitimate interest, the cookie queries and management on that site are most likely outdated.
Finally
Managing cookies and asking the right questions is guaranteed to be a chore if you do it all yourself. Fortunately, there are plenty of options on the market that make banners, cookie labels and maintenance relatively easy, following the letter of the law.
We have handled cookie compliance for a long list of clients, and the consent banner on this site is one we built ourselves. If you would rather have a ready-made tool, Cookiebot is a good option: grab it from that link and we will automatically get the rights to manage it, so we can set up your cookie circus too. Get in touch and we will work out which approach suits you and quote for it.
