When the Cookie Crumbles | GDPR Lawyers explain all

Recently, I have heard radio advertising being promoted as a means to reach your customers without the risk of losing them as a result of the annoying need to click away a cookie banner on every site, link and some additional web pages. Could this mean that other forms of media advertising may benefit from “cookie fatigue”?

You may have noticed the preponderance of cookie banners on websites following the introduction of the General Data Protection Regulation into UK law by the Data Protection Act 2018.  The requirement for notifying users of a website that their personal data is being collected is not a new thing and has been a legal requirement since the original Data Protection Act was passed in 1998.  The “teeth” behind the GDPR however (fines of up to EUR10 million, or, in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year) has meant that website operators are taking their obligations more seriously.

What personal data could a cookie collect?  A cookie may be associated with online identifiers coming from users’ devices and applications, such as IP addresses, cookie identifiers or other identifiers such as radio frequency identification tags. Since “personal data” is any information relating to an individual person which allows that that person to be identified either directly or indirectly, a number of cookies fall foul of this.  As a result, most data collected and processed for the purposes of online behavioural advertising will fall within the ambit of the GDPR.

Of course not all websites use identifying cookies, although if you buy a prepaid website they are likely to be included.  Your cookie banner needs to notify visitors to your website of the fact that personal data is being collected, what this is, and how (if possible) the user can switch off such cookies.  In the absence of the ability to switch cookies off, you must inform your customers that if they proceed to use your website, the data will be collected.

Still, is this any worse than the speeded up “terms and conditions apply” garbled aural smallprint that some radio advertising is obliged to include? I suppose it depends which way the cookie crumbles.

If you would like to know more about your website obligations, please contact Jane Rudge JRudge@Thursfields.co.uk or on 0121 227 3885 or Stuart Price SPrice@Thursfields.co.uk or on 0121 227 3371.