- Where consent is required for cookies under the EU’s e-Privacy Directive (2002/58/EC), the GDPR standard of consent applies, and pre-ticked boxes are not valid. Under the GDPR, ‘consent’ must be freely given, specific, informed and an unambiguous indication of the individual’s wishes by a clear affirmative action.
- The court issued a reminder that the consent rules for cookies as outlined in the e-Privacy Directive apply regardless of whether any personal data is processed by the cookie.
- Website operators must inform users about the duration of the cookie (e.g. how long it will last on a user’s device) and any third party access and sharing.