Common Errors with GDPR Cookie Notice Banners

If you use a GDPR cookie consent notice banner, you need to be familiar with what you'll need to do. However, it's just about as relevant and important to be aware of what not to do.

This article will look at what your cookie consent notice banner must include, and what pitfalls you can avoid when creating one so as to not accidentally be out of compliance.

Some Background

On May 31,2021, the European Center for Digital Rights, a pro-privacy group that goes by the acronym "noyb" (None of Your Business), began a campaign against well-known companies that allegedly used unlawful cookie banners.

The cookie banners used by these companies ostensibly employed practices that fell far outside guidelines dictated by the European General Data Protection Regulation (GDPR). Noyb sent out almost 600 draft complaints to companies throughout the European Union (EU) and European Economic Area (EEA), which they identified as having violated these GDPR regulations.

Max Schrems, an Austrian activist, author, and lawyer co-founded noyb. He became quite well-known following privacy complaints against Facebook. In 2011, Schrems filed complaints against the tech giant with the Irish Data Protection Commissioner (DPC), which to this day have never received a formal decision. Despite that fact, Facebook was forced to disable its facial recognition software and delete specific files after it was audited following Schrem's complaint.

Today, Schrem's organization declares on its website's homepage that "noyb aims to end cookie banner terror." According to the privacy watchdog, "by law, users must be given a clear yes/no option." However, most companies don't do that. They also do not provide any acceptable alternative.

Sometimes, they present all the correct options but then obscure the banner placement or engage in practices, such as the use of so-called "dark patterns," labyrinthine sub-menus, button contrast, and misleading color choices. All of these practices are designed to fool or otherwise frustrate website users into accepting all cookies.

All the companies to which noyb sent notices had one month to "cure" or otherwise rectify EU privacy law violations before formal complaints would be filed with relevant authorities.

It's worth noting that noyb's efforts have primarily been aided by proprietary software the organization developed in-house. The non-profit plans to scan Europe's top 10,000 most-visited websites to identify illegal cookie banner use. When noyb's software determines that a company violates the law, a human legal team then sends a draft complaint to the so-called offenders. The organization also sends the company step-by-step guidance on how to become legally compliant.

According to noyb, there are at least 15 different kinds of violations that break EU privacy laws. Its compliance guide lists each of them. We'll go over key abuses and provide a brief analysis below.

First, however, it's worth noting that similar consent and cookie banner issues came into focus recently. For instance, France's Commission Nationale de l'Informatique et des Libertés (CNIL) sent out formal notices to both companies and public organizations that didn't allow website users to reject cookies as easily as they could accept them.

As of June 29, 2021, all organizations contacted by CNIL adjusted their cookie practices to become compliant with EU law.

How to Update Your Cookie Banner to Comply With the GDPR

Before we dive into specifics, you should understand that even if your company or organization doesn't do business within the EU or EEA, similar laws within the United States, such as The California Consumer Privacy Act (CCPA), demand compliance on this issue as well. Penalties can often be steep. Therefore, it's in your interest as a business owner or executive to ensure your cookie practices meet compliance standards.

With that said, a best practice is to use a consent management platform (CMP), which is a tool used to collect user consent. Here's an example of a consent management platform in action from French bank, Credit Agricole. Note the cookie banner at the bottom. It contains clear buttons for accepting all cookies, denying all cookies, or managing cookies:

GDPR Cookie Requirements

The EU's privacy regulation law currently in force is the GDPR, as noted above. You may already be familiar with it and its cookie requirements, especially if you do business anywhere within the EU. You should also have little excuse not to be compliant since the law has been in effect since 2018.

However, in the off chance that you may not be in full compliance with the law, here's a brief reminder of what is required:

• EU citizens have the right to be informed about all data collected on them
• Businesses are required to inform website users why they are collecting data, how long they keep that data, and with whom they share data
• Under certain circumstances, EU citizens have the right to object to any processing of their personal information, which your organization undertakes

When it comes to keeping website users informed, it's your responsibility to provide them with a privacy notice, which provides "fair processing information." The demand for transparency trumps how you use data.

In other words, your company might do all kinds of things with someone's personal information. The crucial point is that you must make users aware of what you do with that data and then provide them with a means to tell you "no."

GDPR-Compliant Cookie Banner Requirements

As we've noted above, compliance with GDPR requirements concerning cookies means that you need to provide your website visitors with a consent banner. That consent banner is usually created through the use of a consent management platform.

Here are the components that you should include in a compliant cookie consent banner:

• A button to accept cookies: An opt-in approach is the safest way to stay compliant with the GDPR. Additionally, the cookie banner text must explicitly make clear that clicking the button means the user agrees to the use of all cookies.
• A button to deny the use of all cookies, except for those that allow the website to function on the user's browser, and
• A button that leads to detailed information about how your organization uses cookies: You must be explicit about the reasons you use cookies. For instance, you need to state whether cookies are used for social media, analytics, advertising, or for sharing data with third parties, etc.
• Link to your whole Cookies Policy: This policy should list the cookies you use and the purpose of each.
• Link to your cookie settings so that users have the option to manage which cookies they will or will not accept. This is not actually a requirement of the GDPR, but it is a best practice. It's all about respecting your visitors and giving them real choices. However, as long as you provide your website's users with the ability to reject all cookies, then you remain compliant.

Here's an example of a standard, compliant cookie notice banner:

You Can No Longer Ignore the Rules

The truth is that even though the GDPR has been in effect since 2018, many businesses have sought ways to circumvent its regulations concerning cookie banners.

The law was intended to give website users more control over their private information and how businesses use it. Further, it was intentionally designed to provide users a way to deny that data to companies if they disagree with how those companies will use the data. However, people all over the EU and EEA have found themselves in a frustrating situation where businesses regularly ignore aspects of the law.

Alternatively, companies are throwing up cookie banners, saying they comply, but then using dark patterns to ensure that over 90 percent of all users click the accept button. According to industry statistics, that's a problem when only three percent of all users actually agree to accept all cookies.

That's where organizations like noyb come into the picture. They're bridging the gap and identifying thousands of offending businesses.

As Max Schrems, noyb's chairman, has noted:

"Frustrating people into clicking 'okay' is a clear violation of the GDPR's principles. Under the law, companies must facilitate users to express their choice and design systems fairly. Companies openly admit that only 3% of all users actually want to accept cookies, but more than 90% can be nudged into clicking the 'agree' button."

If you're engaging in the kind of shady cookie banner practices noyb outlines, be careful. Noyb's software could identify your business as an offender, and your business reported to the applicable authorities.

Ensure You Don't Engage in These Types of Violations

Noyb has identified the following kinds of violations:

Type A

If you don't feature a "reject" button for all cookies on your homepage (the initial page of your website), you've engaged in a "Type A" violation. According to noyb, Type A violations are the most common.

According to noyb's interpretation of EU law, you must provide website users with a simple yes or no option. The principle involved is that users should be able to refuse cookies as easily as accepting them.

Here's an example of a cookie consent notice that doesn't feature a "reject" type of button:

By neglecting to have a "reject" button, you're violating the GDPR's consent requirement.

Type B

Even if you use a consent management platform, if you also place a pre-ticked box within your settings section to acquire user consent, you're violating the GDPR. The law explicitly states that pre-ticked boxes do not represent consent.

While the following example isn't from a cookie consent notice, the concept still applies. You can't have a pre-ticked checkbox stating that the user agrees to cookies unless he unchecks the box:

Moreover, noyb isn't alone in pointing this out. The EU's highest court, the Court of Justice of the European Union (CJEU), has stated that consent isn't valid if it is provided where a box was pre-checked.

It's in your interest then, to ensure that when it comes to obtaining cookie consent, that you require users to take some kind of affirmative action like clicking a button or actively checking a box to indicate their clear consent.

Here's an example of a cookie consent notice that requests affirmative consent via clicking a clearly-labeled button, while offering a clear method to decline cookies:

Type C

If you use any link design or confusing hyperlinks to "nudge" users into clicking a button that accepts all cookies, you're engaging in a Type C violation.

While the law does not directly demand a specific format or design you must follow when obtaining user consent, it requires that any consent acquired must be informed, unambiguous, precise, and freely given.

Here's an example of a cookie consent notice that really doesn't make it clear at all that by clicking "Got it!" a user is actually consenting to having cookies placed. This can be considered deceptive, and using language to nudge users in a hurry to simply click the seemingly-meaningly "Got it" button:

While a link is provided to more information, not much else is compliant here.

The letter of the law actually gives you more leeway than noyb would like since the GDPR doesn't demand that the option to refuse is placed precisely beside the choice to accept. With that said, noyb's guidelines ensure GDPR compliance and should be considered a best practice in this regard.

Types D and E

Suppose you use misleading button colors and contrast. In that case, you're engaging in a violation that's quite similar to Type C. When you use deceptive colors for your "accept" and "reject" buttons, users tend to click the accept button more often than not, even when they really don't want to accept. For example, noyb points out that many companies use green as a color for the "accept" button. It's similar to a green light at a traffic stop. Green means "go."

On the other hand, these same companies often use the color gray on their "reject" buttons, which causes them to blend in with the CMP background in many cases. In keeping with colors that are regularly used to indicate "no," "stop," "do not proceed," etc., these companies ought to be using the color red for their "reject" buttons. Noyb considers the fact that they do not, deceptive.

In the same way that this sort of thing isn't a direct violation of the law, just as a Type C violation is not, it's still considered a violation of the spirit of the law. It's, therefore, a best practice to ensure the meaning of your button designs, colors, and contrasts are easy to understand and are obvious.

Type H

"Legitimate interest" isn't a valid reason to assume consent when it comes to your cookies. Some companies use the term "legitimate interest" within their cookie banner language and imply that they have the right to place cookies on a user's computer because they have "legitimate interests."

However, this is a violation of the EU ePrivacy Directive, which demands that you obtain valid, explicit consent from users to use all non-essential cookies.

Type I

Some companies flat out lie about the type of cookies they place on a user's computer. They intentionally misclassify non-essential cookies as "essential." This is also a clear violation of the ePrivacy Directive's consent requirements. Be exceedingly careful that you don't engage in practices like this because doing so could lead to a full cookie review by applicable authorities. If you're found in violation, remember that fines and penalties can be stiff.

A debate currently rages as to what cookies are non-essential, but noyb argues that advertising cookies and analytics should not be considered "essential."

Type K

The last violation type has to do with making it hard for a user to withdraw consent. If you don't include in your cookie banners an easy way for users to withdraw consent, then according to noyb, you're in violation of the law.

You can note within your cookie consent banner that consent can be withdrawn at any time, as seen here:

Be aware that neither the ePrivacy Directive nor the GDPR explicitly states such a thing, however. What these laws do demand is that you make it easy for a user to withdraw consent. How you do that is up to you, but noyb's guidelines are logical, ensuring compliance.

Compliant Cookie Banner Example

Here's an example of a compliant, fully adequate cookie consent banner:

Notice that it satisfies the five main demands of the GDPR, which are:

• A button to accept cookies
• It provides detailed information about cookie use
• It gives a link to a list of all third party vendors with whom it shares data
• It provides a link to the website's Cookies Policy, and
• It provides a button to the cookies settings (purposes)

Here's another example of a successful cookie consent notice that lets users know why cookies are being used, lets them know clearly what will happen if they accept, how they can find out more information via links to a Cookies Policy and Privacy Policy, and reminds the user that consent can be withdrawn at any time:

And one more example here of how a compliant cookie consent notice can be crafted. Note how all the necessary information is included:

Summary

If you do business within the EU or EEA and engage in any one of eight different types of violations listed above (remember there are actually at least 15 types and we've merely gone over the most important), you run the risk of being called out and reported for those offenses. That's in addition to efforts at law enforcement by applicable authorities such as CNIL.

Your cookie consent notice should include a number of factors including a link to your full Cookies Policy or Privacy Policy, options to accept or deny/customize what cookies are used, and clear intent to let users know that consent is being requested.

It must not do things like pre-check a consent checkbox, or not offer an option for rejecting or denying cookies. If you engage in certain errors, you may run into

With that in mind, consider it a best practice to review your cookie notice, how you obtain cookie consent, and then make relevant updates as needed to stay compliant as the laws change and lawsuit precedence becomes available.