1. EU/UK Cookie Compliance Requirements
Legislation implementing the ePrivacy Directive 2002/58/EC (“ePrivacy Directive”) is commonly understood as the main law regulating the use of cookies in the European Economic Area (the European Union plus Iceland, Liechtenstein and Norway) and the UK. The ePrivacy Directive applies at an EU level as a Directive but is implemented on a national level (and in the UK) via various local laws.
Laws implementing the ePrivacy Directive in each EU member state and the UK require organizations to:
2. EU / UK Cookie Banner Language
Implementation
3. EU / UK Cookie Preference Manager Language
Implementation
1. California Consumer Privacy Act (“CCPA”) and Similar Cookie Compliance Requirements
The CCPA and other state privacy laws provide residents of their respective states with the right to direct businesses not to “sell” the consumer’s personal information, or “share” / “process” the consumer’s personal information for cross-context behavioral or targeted advertising purposes. This means consumers must be given the option to opt-out of such information sharing directly on the business’s website, such as through the use of a preference manager that allows the consumer to turn OFF Website Trackers that involve the sharing of personal information with third parties (i.e., through a toggle that opts consumers out) in addition to other opt-out mechanisms for “sales” / “targeted advertising” occurring through other channels. Notably, under the CCPA, businesses must include a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link on their website that allows consumers to submit an opt-out request.
In addition to manually turning off such cookies, certain state privacy laws require businesses to be able to receive and effectuate opt-out requests submitted automatically via opt-out preference signals that are transmitted in a format commonly used and recognized by businesses (such as an HTTP header field or JavaScript object). By way of example, the California Attorney General has expressly stated that this includes the recently launched Global Privacy Control. As a result, a business must ensure that its preference manager or similar tool is capable of automatically detecting and effectuating such signals by turning OFF Website Trackers that involve the sharing of personal information with third parties by default.
Notwithstanding the foregoing, even though a cookie banner is not technically required under such laws (only a preference manager is required), we recommend presenting consumers with a cookie banner catered towards these laws to reduce wiretap litigation risk.
2. U.S. Cookie Banner Language – Opt-Out Language
Implementation
3. U.S. Cookie Preference Manager Language
Implementation
As previously discussed, cookie banners are not required by most privacy laws in the United States. However, we have seen an increase in class action litigation targeting the use of non-essential cookies and trackers without appropriate consent. The opt-out banner above is designed to help reduce the risk of such a claim, but there are alternative designs that can be considered.
1. U.S. Cookie Banner Language – Opt-In Language
An opt-in consent banner is the most effective design strategy for reducing class action litigation risk. However, it also has the greatest impact on marketing and analytics effectiveness.
Implementation
2. U.S. Cookie Banner Language – Implied Consent / Notice Only Approach
An implied consent / notice only banner is the least effective design strategy for reducing class action litigation risk. However, it also has the least impact on marketing and analytics effectiveness.
Implementation