EU - Art. 29 Working Party Adopts Opinion on Cookie Consent Exemption

The Article 29 Data Protection Working Party (Art. 29 WP) published on Tuesday the 12th of June its Opinion on cookie consent exemption, which it adopted at its 86th meeting on the 6th and 7th of June in Brussels.

The Opinion provides guidance regarding the application of Article 5.3 (the “cookie ‘consent’ rule”) of the e-Privacy Directive (2002/58/EC), as amended by the Citizen’s Rights Directive (2009/136/EC).

Article 5.3 allows cookies to be exempted from the requirement of informed consent, if they satisfy one of the following criteria:

• the cookie is used “for the sole purpose of carrying out the transmission of a
  communication over an electronic communications network”.
• the cookie is used “for the sole purpose of carrying out the transmission of a
  communication over an electronic communications network”.

Exempted & Non-Exempted Cookies

The Art. 29 WP deems that the following cookies can be exempted from informed consent under certain conditions if they are not used for additional purposes:

1. User input cookies (session-id), for the duration of a session or persistent cookies limited to a few hours in some cases.
2. Authentication cookies, used for authenticated services, for the duration of a session.
3. User centric security cookies, used to detect authentication abuses, for a limited persistent duration.
4. Multimedia content player session cookies, such as flash player cookies, for the duration of a session.
5. Load balancing session cookies, for the duration of session.
6. UI customization persistent cookies, for the duration of a session (or slightly more).
7. Third party social plug-in content sharing cookies, for logged in members of a social network.

The Art. 29 WP considers that the following cookies cannot be exempted:

1. Social plug-in tracking cookies
2. Third party advertising
3. First party analytics

The Art. 29 WP advises that “if substantial doubts remain on whether or not an exemption criterion applies, website operators should closely examine if there is not in practice an opportunity to gain consent from users in a simple unobtrusive way, thus avoiding any legal uncertainty”.

Additional Resources

• The Wall Street Journal published an article ahead of publication of the Art. 29 WP’s Opinion;
• Hunton & Williams published a brief analysis of the Art. 29 WP’s Opinion; and,
• Field Fisher Waterhouse (FFW) produced a table setting out the EU Member States’ implementation of Article 5.3.