(1982,2,'2020-12-10 17:40:12','2020-12-10 17:40:12','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the&nbsp;European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising&nbsp;intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data&nbsp; exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about&nbsp;it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“&nbsp; <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent&nbsp;without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019 &nbsp;“<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>&nbsp; (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters&nbsp; used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms &nbsp;will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Marie-Claire PEROUX LLM</strong> is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe, <a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> </em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photo kindly provided by Marie-Claire PEROUX ©</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','','inherit','closed','closed','','1964-revision-v1','','','2020-12-10 17:40:12','2020-12-10 17:40:12','',1964,'https://www.datarainbow.eu/1964-revision-v1/',0,'revision','',0),(1983,2,'2020-12-10 21:26:58','2020-12-10 21:26:58','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information). An injunction to delete unlawfully collected and processed data was not ordered.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2019, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In June 2019, <a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by Celestin Matte, <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;IEEE Symposium on Security and Privacy (IEEE S&amp;P 2020) question : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://www-sop.inria.fr/members/Nataliia.Bielova/papers/Matt-etal-20-SP.pdf\" target=\"_blank\">Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework</a> Nataliia Bielova, Cristiana Santos. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a second paper, submited in September 2020, the group question : \'<a href=\"https://hal.inria.fr/hal-02875447#:~:text=We%20perform%20a%20technical%20assessment,current%20architecture%20of%20the%20web.\"><em>Are cookie banners indeed compliant with the law</em>?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a paper submited July 2018 entitled \'<em><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/s/file/preview/181819110/1808.05096.pdf?pearlId=231196296\" target=\"_blank\">We Value Your Privacy … Now Take Some Cookies : Measuring the GDPR’s Impact on Web Privacy\'</a></em>  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub and Thorsten Holz from the Ruhr-Universität Bochum, Germany and thr University of Michigan, Ann Arbor, MI, USA, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>monitored and analysed the GDPR’s impact on popular websites in all 28 member states of the European Union.</li><li>They found that 84.5 % of websites had a privacy policy. </li><li>72.6 % of websites with existing privacy policies<br>updated them close to the ebtry into force of the GDPR.</li><li>62.1 % of websites displayed cookie consent notices, 16 % more than in January 2018. These notices inform users about a site’s cookie use and user tracking practices. </li><li>They observed cookie consent notices and evaluated 16 common implementations<br>with respect to their technical realisation of cookie consent.<br>This revealed that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third party cookies requires the third party to cooperate. In conclusion, they fond that the GDPR is making the web more transparent, while it still  lacks of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.</li><li>For each country, the 500 most popular websites were examined for the presence of and updates to their privacy policy.</li></ul>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In January 2020, another study was published <em><a rel=\"noreferrer noopener\" href=\"https://arxiv.org/abs/2001.02479\" target=\"_blank\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a></em><a href=\"https://arxiv.org/search/cs?searchtype=author&amp;query=Nouwens%2C+M\"> </a>by Midas Nouwens,&nbsp;Ilaria Liccardi,&nbsp;Michael Veale,&nbsp;David Karger,&nbsp;Lalana Kagal (UCL, MIT and Aarhus University), suggests that many cookie consent pop-ups are flouting EU privacy laws. and noticed that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"New consent management platforms (CMPs) have been introduced to the web to conform with the EU\'s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users\' personal data. This work analyses how the most prevalent CMP designs affect people\'s consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). </p><p>We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. <strong>We found that notification style (banner or barrier) has no effect</strong>; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>An illusion of control and transparency?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Max Schrems with his team used the INRIA\'s research group tool \"<em>Cookie Glasses</em>\" to validate their findings and to file complaints to the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the&nbsp;<a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','publish','open','open','','cookies-are-not-yummies','','https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\nhttps://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/','2020-12-15 00:23:55','2020-12-15 00:23:55','',0,'https://www.datarainbow.eu/?p=1983',0,'post','',0),(1985,2,'2020-12-10 21:26:30','2020-12-10 21:26:30','Photography by Vanja Munerati ','Photography by Vanja Munerati','Photography by Vanja Munerati ','inherit','open','closed','','screenshot-2020-12-10-at-19-54-09','','','2020-12-10 21:38:32','2020-12-10 21:38:32','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.54.09.png',0,'attachment','image/png',0),(1986,2,'2020-12-10 21:26:58','2020-12-10 21:26:58','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being published here since the latest enforcements by national Data Protection authorities : The French CNIL fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google: <a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon: <a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the [<a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003] or PECR</a> for its implementation in the UK or the French <a href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 of the [Loi « Informatique et Libertés »].</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement made .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- It can no longer be relied on implied consent for the use of cookies ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The [European Data Protection Board] published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a free, informed and unambiguous consent, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.  For non-essential cookies, pre-ticked boxes or equivalent default fixtures are not allowed, and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the WP art 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019, <a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed <a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>] against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be concise, transparent, intelligible and easily accessible (Article 12.1);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>  and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a> Directive and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a  post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding  what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following  the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is a legislative piece no one better than lawyers could read and implement. Lawyers handle sensitive data bound under professional confidentiality.  Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar.s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter  for all lawyers to send to this website. This is wrong from several angles. GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers are invited to send the letter with a copy of their ID card. of the publicly available data by providing further personal that `In other words, to complain against the usw`</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another recommended request is to enquire about the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, has rushed to make their website in order, using a cookie management tool [Tarteaucitron].</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, they are fears that data would leak from their website outside the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm websites are in the same poor state&nbsp; Despite the CNB having procedure an exhaustive [guidance] on what should be implemented. Is this an application of the old principle “do what you are told, not what we do’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences or ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>>>>The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 ECJ decision has rolled out all requirements for web cookies and tracking, not limited to personal data, prohibiting cookie walls.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','','inherit','closed','closed','','1983-revision-v1','','','2020-12-10 21:26:58','2020-12-10 21:26:58','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1987,2,'2020-12-10 21:37:05','2020-12-10 21:37:05','Photography by Vanja Munerati ','Photography by Vanja Munerati','Photography by Vanja Munerati ','inherit','open','closed','','screenshot-2020-12-10-at-21-35-57','','','2020-12-10 21:41:21','2020-12-10 21:41:21','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-21.35.57.png',0,'attachment','image/png',0),(1990,2,'2020-12-10 21:42:08','2020-12-10 21:42:08','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being published here since the latest enforcements by national Data Protection authorities : The French CNIL fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the [<a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003] or PECR</a> for its implementation in the UK or the French <a href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»].</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement made .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- It can no longer be relied on implied consent for the use of cookies ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The [European Data Protection Board] published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a free, informed and unambiguous consent, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, pre-ticked boxes or equivalent default fixtures are not allowed, and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the WP art 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be concise, transparent, intelligible and easily accessible (Article 12.1);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is a legislative piece no one better than lawyers could read and implement. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar.s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter&nbsp; for all lawyers to send to this website. This is wrong from several angles. GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers are invited to send the letter with a copy of their ID card. of the publicly available data by providing further personal that `In other words, to complain against the usw`</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another recommended request is to enquire about the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, has rushed to make their website in order, using a cookie management tool [Tarteaucitron].</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, they are fears that data would leak from their website outside the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm websites are in the same poor state&nbsp; Despite the CNB having procedure an exhaustive [guidance] on what should be implemented. Is this an application of the old principle “do what you are told, not what we do’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences or ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 ECJ decision has rolled out all requirements for web cookies and tracking, not limited to personal data, prohibiting cookie walls.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-10 21:42:08','2020-12-10 21:42:08','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1989,2,'2020-12-10 21:39:32','2020-12-10 21:39:32','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being published here since the latest enforcements by national Data Protection authorities : The French CNIL fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the [<a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003] or PECR</a> for its implementation in the UK or the French <a href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»].</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement made .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- It can no longer be relied on implied consent for the use of cookies ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The [European Data Protection Board] published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a free, informed and unambiguous consent, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, pre-ticked boxes or equivalent default fixtures are not allowed, and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the WP art 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be concise, transparent, intelligible and easily accessible (Article 12.1);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is a legislative piece no one better than lawyers could read and implement. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar.s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter&nbsp; for all lawyers to send to this website. This is wrong from several angles. GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers are invited to send the letter with a copy of their ID card. of the publicly available data by providing further personal that `In other words, to complain against the usw`</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another recommended request is to enquire about the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, has rushed to make their website in order, using a cookie management tool [Tarteaucitron].</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, they are fears that data would leak from their website outside the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm websites are in the same poor state&nbsp; Despite the CNB having procedure an exhaustive [guidance] on what should be implemented. Is this an application of the old principle “do what you are told, not what we do’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences or ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 ECJ decision has rolled out all requirements for web cookies and tracking, not limited to personal data, prohibiting cookie walls.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','','inherit','closed','closed','','1983-revision-v1','','','2020-12-10 21:39:32','2020-12-10 21:39:32','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1992,2,'2020-12-11 12:05:35','2020-12-11 12:05:35','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi « Informatique et Libertés »</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.  For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is a legislative piece no one better than lawyers could read and implement. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar.s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter&nbsp; for all lawyers to send to this website. This is wrong from several angles. GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers are invited to send the letter with a copy of their ID card. of the publicly available data by providing further personal that `In other words, to complain against the usw`</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another recommended request is to enquire about the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, has rushed to make their website in order, using a cookie management tool [Tarteaucitron].</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, they are fears that data would leak from their website outside the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm websites are in the same poor state&nbsp; Despite the CNB having procedure an exhaustive [guidance] on what should be implemented. Is this an application of the old principle “do what you are told, not what we do’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences or ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 ECJ decision has rolled out all requirements for web cookies and tracking, not limited to personal data, prohibiting cookie walls.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 12:05:35','2020-12-11 12:05:35','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1993,2,'2020-12-11 12:22:34','2020-12-11 12:22:34','','Screenshot-2020-12-11-at-12.22.04','','inherit','open','closed','','screenshot-2020-12-11-at-12-22-04','','','2020-12-11 12:22:34','2020-12-11 12:22:34','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04.png',0,'attachment','image/png',0),(1994,2,'2020-12-11 12:34:48','2020-12-11 12:34:48','','Screenshot-2020-12-11-at-12.33.31','','inherit','open','closed','','screenshot-2020-12-11-at-12-33-31','','','2020-12-11 12:34:48','2020-12-11 12:34:48','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31.png',0,'attachment','image/png',0),(1995,2,'2020-12-11 12:35:04','2020-12-11 12:35:04','','Screenshot-2020-12-11-at-12.33.56','','inherit','open','closed','','screenshot-2020-12-11-at-12-33-56','','','2020-12-11 12:35:04','2020-12-11 12:35:04','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56.png',0,'attachment','image/png',0),(1999,2,'2020-12-11 13:23:45','2020-12-11 13:23:45','','Screenshot-2020-12-10-at-19.42.08','','inherit','open','closed','','screenshot-2020-12-10-at-19-42-08','','','2020-12-11 13:23:45','2020-12-11 13:23:45','',1983,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08.png',0,'attachment','image/png',0),(2000,2,'2020-12-11 13:23:53','2020-12-11 13:23:53','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the&nbsp;<a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 13:23:53','2020-12-11 13:23:53','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1996,2,'2020-12-11 12:53:51','2020-12-11 12:53:51','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi « Informatique et Libertés »</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.  For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.  Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state. Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17) </a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the <a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the <a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ANd here a great in depth article by Marie-Claire Peroux LLM : <a href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\" rel=\"noreferrer noopener\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 12:53:51','2020-12-11 12:53:51','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1997,2,'2020-12-11 12:54:38','2020-12-11 12:54:38','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi « Informatique et Libertés »</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.  For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.  Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state. Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17) </a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the <a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the <a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer.</p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 12:54:38','2020-12-11 12:54:38','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(1998,2,'2020-12-11 12:57:29','2020-12-11 12:57:29','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi « Informatique et Libertés »</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.  For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.  Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state. Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17) </a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the <a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the <a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <strong>Vanja Munerati</strong> who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 12:57:29','2020-12-11 12:57:29','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2001,2,'2020-12-11 19:56:32','2020-12-11 19:56:32','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many websites have included cookie banners to require visitors consent. Not all cookie banners are actually disabling with respect to visitors consent denial. A study published by <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;and Célestin Matte question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the&nbsp;<a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-11 19:56:32','2020-12-11 19:56:32','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2002,2,'2020-12-11 21:34:12','2020-12-11 21:34:12','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU Commission\'s draft Implementing Decision on SCCs</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ U.K. ICO fined BA in cooperation with the French CNIL</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ And the Marriott International fined.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Meanwhile US might have voted for a new President😍.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ The older president is stock in and will be tough job getting him out.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Cyberattack is as ever high.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Data security and protection more crucial than ever. ENISA published its alarming report</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅CJEU\'s judgment in Orange România case</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ENISA Guidelines on Securing the IoT Supply Chain</a></li><li>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></li><li><a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000042499856?tab_selection=all&amp;searchField=ALL&amp;query=433311&amp;page=1&amp;init=true\"> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','From the ban of encryption to the ICO fines, Cyberattacks on the rise.','inherit','closed','closed','','1076-revision-v1','','','2020-12-11 21:34:12','2020-12-11 21:34:12','',1076,'https://www.datarainbow.eu/1076-revision-v1/',0,'revision','',0),(2003,2,'2020-12-11 21:35:54','2020-12-11 21:35:54','<!-- wp:paragraph -->\n<p>In the week that the world started celebrating the news that not one but three experimental vaccines against Covid-19 have proved at least 90% effective at preventing disease in late-stage clinical trials, research into understanding how the Sars-CoV-2 virus, which causes Covid-19, interacts with the human immune system never paused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are plenty of questions still to answer about the Pfizer/BioNTech and Moderna vaccines and now the Oxford and AstraZeneca and how well they might protect the elderly, for example, and how long for? Which aspects of the immune response that they elicit are protective and which aren’t? Can even better results be achieved, with vaccines that target different parts of the immune system. However, one question that seems to be overlooked by the entire world whilst celebrating, is what security measures are in place to secure the research and development and to stop counterfeit copies that are not as effective or only replicate a % of the real vaccine? It certainly does not seem important for the organisations involved as the research and findings below evidence.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On 11th May 2020 Archer, the UK national supercomputing service that was collating Covid-19 research and developments, was breached reportedly by Russia and Chinese state sponsored groups stealing the IP and data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1975,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.02.png\" alt=\"\" class=\"wp-image-1975\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Initially blamed for being targeted to be used for crypto currency mining, the rationale for the attack quickly became clear. $billions in research and developments in Covid-19. Archers homepage became Not Secure, unencrypted with no data integrity several weeks prior to the attack when its digital certificate was allowed to expire. Bizarrely, it remains Not Secure to this day and as a government managed supercomputer, defies all<br>rationale of security and remains a major target.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was also in the weeks leading up to the Archer breach in May that our research discovered Oxford University was maintaining a Not Secure homepage. We continuously informed Oxford University that they were maintaining sub optimal internet facing domains and a homepage that was Not Secure in the same way Archer were. This was ignored for months. Although Oxford did not report a breach at this time, it is important to note they receive £100’s of millions in grants for research and work closely with Archer, as do many of the Pharmaceutical organisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1976,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.24.png\" alt=\"\" class=\"wp-image-1976\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>With the further news of the Covid-19 vaccines we started researching the other Pharmaceutical companies to ensure they were not compromised facing the internet and to our disbelief, when we researched Pfizer. Our research discovered Pfizer are also running sub optimal internet facing domains. We quickly alerted the Board of Pfizer and have yet to receive confirmation or a reply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1977,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.34.png\" alt=\"\" class=\"wp-image-1977\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Our research took us onto Moderna and AstraZeneca. The same situation of negligence of security facing the internet at Moderna and AstraZeneca confirms and shows a worrying systemic security issue that makes one consider, and question the motivation to secure, what could be considered the world’s most incredible development in many generations. Yet at every single organisation, security of IP and data has absolutely no consideration or focus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1978,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.57.41.png\" alt=\"\" class=\"wp-image-1978\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>The pharmaceutical sector is among the very highest of sectors targeted for cyber attacks and a Covid-19 vaccine may be the single largest development in modern times. So why is the research and development on vaccines open to cyber attacks and IP theft?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Andy Jenkinson</strong> is a thought provoking, challenging consummate professional and natural leader whose drive, energy and enthusiasm is not only infectious but inspirational ensuring everyone succeeds together as a group. Andy has a no nonsense attitude to security, be that internal PKI or internet facing and is renowned for his candour and straight forward approach. If you want security, you might not like what you hear, but you’ll love the results.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Andrew&nbsp;Jenkinson​|Group&nbsp;CEO</td></tr><tr><td><a rel=\"noreferrer noopener\" href=\"tel:+447894%20062867\" target=\"_blank\"><strong>+447894&nbsp;062867</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/d67da364-a0d7-42e0-89c6-9e07535ec26a\"><a rel=\"noreferrer noopener\" href=\"mailto:andrew.jenkinson@cybersecip.com\" target=\"_blank\"><strong>andrew.jenkinson@cybersecip.com</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/8422d502-0bb1-4389-aefb-dff23909f81c\"><a rel=\"noreferrer noopener\" href=\"http://www.cybersecip.com/\" target=\"_blank\"><strong>www.cybersecip.com</strong></a><a rel=\"noreferrer noopener\" href=\"https://www.cybersecip.com/\" target=\"_blank\"></a></td></tr><tr><td></td></tr></tbody></table></figure>\n<!-- /wp:table -->','COVID 19: Security & Protection Concerns','More than ever during this COVID-19 pandemic, online security and keeping websites secure has become a priority.','inherit','closed','closed','','1970-revision-v1','','','2020-12-11 21:35:54','2020-12-11 21:35:54','',1970,'https://www.datarainbow.eu/1970-revision-v1/',0,'revision','',0),(2004,2,'2020-12-11 21:36:57','2020-12-11 21:36:57','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the&nbsp;European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising&nbsp;intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data&nbsp; exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about&nbsp;it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“&nbsp; <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent&nbsp;without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019 &nbsp;“<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>&nbsp; (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters&nbsp; used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms &nbsp;will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Marie-Claire PEROUX LLM</strong> is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> </em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photo kindly provided by Marie-Claire PEROUX ©</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data  exchanges.','inherit','closed','closed','','1964-revision-v1','','','2020-12-11 21:36:57','2020-12-11 21:36:57','',1964,'https://www.datarainbow.eu/1964-revision-v1/',0,'revision','',0);
