Compliance Management, Government Regulations, Privacy

Dutch Data Protection Authority chips away at ‘cookie walls,’ declaring they violate GDPR

Websites that restrict visitors from viewing and interacting with their content unless they first accept the use of cookies that track their browsing activities are violating the terms of the European Union's General Data Protection Regulation (GDPR), the Netherlands' Dutch Data Protection Authority (DDPA) has determined.

Also known as the Autoriteit Persoonsgegevens (AP), the DDPA said in a statement late last week that it is intensifying audit and compliance efforts and has contacted certain offending parties after receiving dozens of complaints from citizens who were denied access to web pages after refusing to accept cookie policies.

Under GDPR, website operators are allowed to request user permission to employ cookies, but that permission must be given freely. The use of so-called cookie walls that block users from accessing sites unless they accept cookies are therefore out of GDPR compliance because they effectively coerce users into granting permission, the AP argues.

AP Chairman Aleid Wolfsen said in a roughly translated statement, "The digital tracking and recording of internet surfing behavior via tracking software or other digital methods is one of the largest processing of personal data, because virtually everyone is active on the internet. To protect privacy, it is therefore important that parties request permission from website visitors."

"In this way, people can deliberately and appropriately use their right to the protection of personal data," the statement continues. "If a website is asked for permission for tracking cookies and if it is not possible to access the website or service if they refuse access to the website or service, people under pressure will receive their personal data and that is unlawful."

"For years, the internet has enabled organizations to conduct surveillance on unwary consumers. This practice is now being upended by GDPR, the California Consumer Privacy Act (CCPA) and similar laws being passed around the world," said Chris Olson, CEO of The Media Trust, in a statement. "To demonstrate their seriousness about protecting consumer privacy, GDPR regulators are closing the loopholes on obtaining site visitors' consent for collecting their behavioral and personal data. And they are not alone in clamping down on websites that deny access to consumers who exercise their privacy rights. Under CCPA, companies cannot discriminate against Californians who decline the collection and distribution of their information. The key takeaway here is for companies to operationalize the spirit of these laws. Doing so will not only lower the risk of infringement but also build customer trust, which is essential to the customer experience."

GDPR went into effect last May, while the CCPA will become official on Jan. 1, 2020.

"There's been a lot of confusion in [the] industry, and ambiguity in regulatory interpretation, concerning the adapting of online content distribution and ads to GDPR," said Omer Tene, VP and chief knowledge officer with the International Association of Privacy Professionals (IAPP). "In this case, the Dutch DPA expressed a restrictive reading. In other cases, other DPAs applied the legislative language more liberally. We will inevitably face a period of uncertainty, which is anathema for businesses, until the dust settles and we know how websites can set cookies to monetize their services."

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.