Article 29 WP’s opinion on the cookie exemptions

By EDRi · June 20, 2012

This article is also available in:
Deutsch: [Artikel 29 Gruppe über Ausnahmen für den Einsatz von Cookies | https://www.unwatched.org/EDRigram_10.12_Artikel29_Gruppe_ueber_Ausnahmen_fuer_den_Einsatz_von_Cookies?pk_campaign=edri&pk_kwd=20120620]

On 12 June 2012, the Article 29 Working Party (WP 29) published an
opinion on the issue, focusing on two exemption criteria established by
the new cookie-related provisions in the ePrivacy Directive:

A- the use of the cookie “for the sole purpose of carrying out the
transmission of a communication over an electronic communications
network” and
B – the use of a cookie if “strictly necessary in order for the provider
of an information society service explicitly requested by the subscriber
or user to provide the service”.

WP 29 established in its opinion the circumstances when the exemption
criteria do not apply such as forcing controllers, processors, and third
party actors to obtain informed consent before using a cookie.

As regarding criterion A, the WP 29 considers this exemption can be used
only when the cookies are pivotal to the transmission of the
communication and when the transmission is not be possible without the
use of the cookies. “Simply using a cookie to assist, speed up or
regulate the transmission of a communication over an electronic
communications network is not sufficient,” says the opinion.

Regarding criterion B, the opinion says: “There has to be a clear link
between the strict necessity of a cookie and the delivery of the service
explicitly requested by the user for the exemption to apply.”

Cookies served for the purposes of providing a specific functionality
within websites will not be considered “strictly necessary” unless “the
functionality will not be available” without the cookie and the user has
“explicitly requested” the functionality from the website.

According to the opinion, some cookies can be exempted from informed
consent under certain conditions if they are not used for additional
purposes – these cookies include for example “user-input” cookies (used
to keep track of the user’s input when filling online forms or as a
shopping cart, also known as session-id cookies), multimedia player
session cookies and user interface customization cookies (for example
language preference cookies to remember the language selected by a user).

The cookies that should not be covered by the exemption include social
plug-in tracking cookies; third party advertising cookies, third party
and first party analytics cookies.

Regarding third party and first party analytics cookies, WP 29 remarks
however that they carry low privacy risks when they are limited to first
party aggregated statistical purposes and when used by websites which
also provide adequate privacy safeguards.

WP 29 also believes e-Privacy Directive should be amended in order to
introduce a new exemption to consent “for cookies that are strictly
limited to first party anonymized and aggregated statistical purposes.”

Opinion 04/2012 on Cookie Consent Exemption (7.06.2012)
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf

Article 29 Press Release on cookie consent exemption (12.06.2012)
http://www.statewatch.org/news/2012/jun/eu-wp-29-dp-cookies.pdf

Websites may only place cookies without user consent if services would
not work without them, say regulators (13.06.2012)
http://www.out-law.com/en/articles/2012/june/websites-may-only-place-cookies-without-user-consent-if-services-would-not-work-without-them-say-regulators/