There has been a fair amount of noise about having a cookie notice and cookie policy over the last few years. There is a lot of confusion about who actually needs to have a cookie notice and policy. If you do need one, what should it look like and how should it be implemented? There has also recently been the Planet49 Judgment which considers various cookie notices and their validity. We can help answer these questions for you and ensure that you have a good cookie notice and policy so that you avoid the risk of non-compliance.

Does my website use cookies?

You might wonder whether you are using cookies at all. The answer will probably be yes, as most websites use cookies, e.g. for social media plugins or shopping baskets. There are several online tools like CookieServe or CookieMetrix that identify and provide information on your cookies. You can also view what cookies your website uses through the developer tool in your browser.

Who has to have a cookie notice and policy?

The EU is still working on a new ePrivacy Regulation that will govern the use of cookies with the same broad territorial scope as the GDPR. It was supposed to come into force at the same time as the GDPR in 2018. But, so far it has not been enacted. The GDPR and the ePrivacy Regulation will form the two pillars of data protection law in the EU.

In the meantime, an “old” directive from 2002 on ePrivacy still applies. The scope, however, is limited to EU-based companies. The European Directive 2002/58/EC requires member states to regulate the use of cookies. In order to give effect to the directive, member states have had to implement their own laws. An example of such a law is the PECR in the UK. If you are using cookies as an EU-based company, the directive requires you to inform the data subject that you are doing so. You also need to provide the reasons for collecting their information. Since an amendment of the directive in 2009, you also need to get the data subject’s consent for storing any cookies on their device.

Non-EU-based companies that target EU individuals might still need cookie consent. If cookies collect personal data, as most of them do (e.g. marketing cookies), the GDPR applies. So it’s important to ask yourself: must I comply with the GDPR?

So if your business or website is based in the EU, has any EU customers or monitors the behaviour of EU individuals, it’s a good idea to get consent to use cookies.

South Africa is likely to follow in the EU’s footsteps when it comes to regulating the law on cookies. So you may as well implement a notice and policy now even if you are unsure as to whether you have to or not.

When do I need one by?

In short, yesterday. In the UK, if you use cookies, you should have implemented a notice and policy by 25 May 2018. So it’s a good idea to get started if you haven’t already.

What are some of the obvious changes that need to be made?

In October 2019, the court in the Planet49 Judgement emphasised the requirement that your cookie notice must allow for a data subject to give free and informed consent. It held that you may not use pre-ticked boxes in your cookie notice. Having a pre-ticked box does not meet the standards of free and informed consent. In addition, you need to disclose how long a cookie will remain on a data subject’s device. So you will need to review your cookie policy to see if it contains this information.

What is the risk of not having one?

As most websites already have cookie notices and policies, visitors to your website will think that you are immature from a compliance perspective. They may also get the impression that you simply don’t take privacy seriously. This may have a serious impact on your reputation in the eyes of investors, stakeholders, customers and possibly even employees. You may also be liable for a fine. This is the case in the UK if you do not comply with the provisions of the PECR.

How we can help you?

Use software to do this automatically

There is software that can create a cookie notice and generate a policy for you in an automated way. This is first prize as it solves the problem for you. It also gives you the ability to be very granular with your website visitors. In addition, it continually updates your cookie notice and policy as things change. The problem with this option is that it is often difficult to choose which software is the right fit for your organisation. The software also comes with a price tag. But if you are an organisation that uses cookies extensively and you really want to show the world that you take privacy and compliance seriously, this is probably the right option for you.

We have spent a lot of time and have extensive experience with various software tools that are useful for cookies. We can help you to choose the right software to use and help you implement it correctly. To kick off this process, enquire on the right and we will be in touch with you to assist.

Update your existing cookie notice and cookie policy

If you already have a cookie notice and policy on your website, the chances are that it’s been there for some time. You should consider updating it to bring it in line with the latest judgments and other developments. This doesn’t take a significant amount of time and isn’t particularly tricky, if you know what you are doing. There are two ways we can help you achieve this:

  1. You can do it yourself by joining the Michalsons data protection programme and then work through the module on implementing a cookie notice and consent. You can join the programme just to fix your cookies and then leave. Alternatively, you might choose to stay in the programme and work through various other data protection modules. There is a monthly fee to join the programme so you can join and leave whenever you want.
  2. You can ask Michalsons to do it for you by asking us to review and update your notice and policy. This is generally a more expensive option, but we understand that for some people doing it themselves is intimidating and they would prefer to delegate the task to somebody else. Many people are also simply just too busy to do this.

Implement a new cookie notice and cookie policy

If you don’t currently have a cookie notice and policy and it’s recently come to your attention that you do need one, there is no time to lose. Here you also have two options:

  1. You can do it yourself with the assistance of the implementing a cookie notice and consent module in the Michalsons data protection programme.
  2. You can ask Michalsons to draft and implement your cookie notice and policy for you.