4

I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect?

Say Bob is not only pissed off by the ostensible (as he thinks) necessity to implement the cookie accept buttons, but, instead of doing that, he is ballsy enough to write this sort of fine print on his website:

We will set whatever cookies we want and we won't ever ask your permission. We don't care what you think the law about it is. Take it or leave it (or sue us).

How soon would events occur which will make Bob change his mind and give in? What sort of events?

I would expect that the likely repercussions would pretty much depend on two factors:

  1. Jurisdiction (perhaps the most severe ones would occur in the EU)
  2. Popularity of the website (perhaps blog / small forum owners don't need to worry as much as big social network owners)

As I think case law on the subject would still be rather scarce, I leave this question jurisdiction-open (please tag your answer accordingly).

David Siegel
  • 115,406
  • 10
  • 215
  • 408
Greendrake
  • 28,487
  • 5
  • 71
  • 135

2 Answers2

7

(, , )

The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet this definition of consent, so any non-necessary cookies set in that context would be a violation.

But it would be the national ePrivacy implementation that would be violated, not the GDPR. Thus, the GDPR's famous 4%/EUR 20M fines are not relevant here. Instead, each country can set its own fines. In Germany, this would probably be up to EUR 50k (§16 TMG) though German law doesn't implement this aspect of ePrivacy correctly. In the UK, PECR penalties are determined by more general data protection penalty legislation.

Notable instances of cookie consent enforcement include the Planet 49 (ECJ judgement, German BGH verdict) case which basically affirmed that yes, the GDPR's definition of consent applies. Thus, any case law regarding GDPR consent is also applicable to the issue of cookies. Furthermore, the Spanish AEPD has issued an interesting fine due to insufficient cookie consent, but due to much more subtle violations than the outright disregard in the given example. E.g. in the Vueling action (decision (Spanish, PDF), summary, listing on enforcementtracker), the Vueling airline's website had a consent banner but ultimately told the user to reject cookies via their browser settings. This violates the requirement that consent must be specific/granular, since the browser settings are all-or-nothing if they're available at all. The airline was fined EUR 30k, the maximum possible under applicable Spanish data protection law.

But what kind of risks would some blog run into that just sets cookies without appropriate consent?

  • If the service is outside of the EU, enforcement is difficult. I am not aware of cookie consent enforcement against non-EU services.
  • National data protection authorities can investigate the violation and issue fines, subject to their respective national data protection laws. They generally only do this when there are lots of complaints. Some authorities like the UK ICO have indicated that cookie consent enforcement isn't a priority for them.
  • Independently, individuals can generally sue the service for damages. Some lawyers might send out cease and desist letters to non-compliant websites in the hopes of collecting fees.

So aside from the last point, the risk is likely somewhat low, especially for a smaller site.

At this point, it is worth reminding that ePrivacy/GDPR doesn't require consent for all cookies, and is not just limited to cookies. It is more generally about access to and storage of information on a user's device, unless that access is strictly necessary to provide the service explicitly requested by the user. Thus, functional cookies can be set without consent. However, consent does become necessary when cookies or similar mechanisms are used for analytics, tracking, or ads. Even though GDPR is involved, the cookie consent requirements apply regardless of whether the cookies involve any personal data.

amon
  • 24,244
  • 3
  • 46
  • 77
5


Bob could be fined (not sued) by supervising authorities (not users).

Those fines can be hefty if the cookies contained PII (€20M or 4% of global revenue, whichever is higher), less so if they don't. The likelihood of being fined, and the amount, depend on coming to the attention of the authorities and the severity of the breach. So far most national supervising authorities have been far less extreme.

He can then "countersue" against that fine, which would be Bob going to court, not any user.

o.m.
  • 22,932
  • 3
  • 45
  • 80