GDPR and Cookies
The General Data Protection Regulation (GDPR - EU Regulation 2016/679) is the European regulation governing the processing of personal data. In effect since May 25, 2018, the GDPR has revolutionized the way companies must manage online user data.
Regarding cookies and tracking technologies, the GDPR establishes that user consent must be free, specific, informed, and unambiguous. This means that every website using non-essential cookies must obtain explicit consent before installing them.
Important: The GDPR applies to all websites that process data of users residing in the European Union, regardless of where the company is headquartered.
Who does the GDPR apply to?
- Websites and e-commerce platforms that collect EU user data
- Web and mobile applications that use cookies or tracking technologies
- Platforms offering services to users in the European Union
- Any online activity that processes personal data of European citizens
Cookie Banner: Obligations and Requirements
The cookie banner is the main tool through which a website informs users about cookie usage and collects their consent. Under current regulations, the banner must appear on the user's first visit and must meet specific technical and legal requirements.
Mandatory Cookie Banner Elements
- Clear information: Simple and understandable explanation of which cookies are used and for what purpose
- Accept button: A clear button to accept all cookies
- Reject button: An equally visible button to reject non-essential cookies
- Granular management: The ability to choose which cookie categories to accept
Warning: Continuing browsing or scrolling the page CANNOT be considered valid consent. The Data Protection Authority has clarified that consent must be an explicit and positive action.
Data Protection Authority Guidelines 2022
With the provision of June 10, 2021 (effective January 9, 2022), the Data Protection Authority issued the new "Guidelines on cookies and other tracking tools." These guidelines introduced important changes that every website must comply with.
Key changes
Prior blocking
Non-essential cookies must be blocked until the user provides explicit consent.
Reject button
The banner must have a reject button with the same visibility as the accept button.
Granular consent
The user must be able to individually choose which cookie categories to accept.
No cookie wall
It is not allowed to condition website access on cookie acceptance (with some exceptions).
No scroll as consent
Page scrolling can no longer be considered a valid form of consent.
Consent withdrawal
The user must be able to withdraw consent at any time in a simple and quick way.
Consent validity
Cookie consent has a maximum validity of 6 months, after which the banner must be presented to the user again. Furthermore, consent must be documented and stored to demonstrate compliance in case of audits.
Technical Requirements for Compliance
To be compliant with regulations, your website must meet a series of specific technical requirements. Here is a complete list of what needs to be implemented:
Cookie Banner
- Must appear on the user's first visit
- Must contain a clear and understandable brief information notice
- Must have an accept and reject button with equal prominence
- Must allow granular management of cookie categories
- Must be accessible at all times to change preferences
- Must not use deceptive practices (dark patterns)
Prior script blocking
- All non-essential cookies must be blocked before consent
- Third-party scripts (Google Analytics, Facebook Pixel, etc.) must be loaded only after consent
- Blocking must be implemented server-side or through a tag manager
- Technical cookies necessary for the site's operation are exempt from blocking
Consent registry
- Each consent must be registered with a timestamp
- It must be possible to identify the user who gave consent
- Expressed preferences must be stored
- The registry must be accessible for possible audits by the Authority
Required documentation
- Updated and detailed Privacy Policy
- Cookie Policy with a complete list of cookies used
- Record of processing activities (for companies with more than 250 employees)
The Consent Archive
The consent archive (or consent registry) is an obligation introduced by the GDPR that requires data controllers to be able to demonstrate that consent was actually obtained. This applies not only to cookies but to any form of consent collected online.
Art. 7 GDPR: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data."
What does this mean in practice?
Every time a user interacts with a consent mechanism on your site (cookie banner, contact form, newsletter subscription, etc.), you must keep proof of that consent. This proof must include who gave consent, when, to what, and how.
Which consents to archive?
All consents collected through your website must be archived and stored. Here are the main ones:
Cookie Consent
Every interaction with the cookie banner must be recorded with the expressed preferences.
Contact Form
The data processing consent expressed through contact forms.
Newsletter
Newsletter subscription with proof of consent (double opt-in).
E-commerce
Consents related to terms of service, marketing, and profiling.
User Registration
Consent expressed during account creation.
Marketing & Profiling
Specific consents for direct marketing and profiling activities.
Registry content
Each consent registry record must contain the following information:
- User identifier: Email, user ID, or other unique identifier
- Timestamp: Exact date and time the consent was given
- Type of consent: Cookie, privacy policy, marketing, etc.
- Information version: Which version of the privacy/cookie policy the user consented to
- Method: How the consent was collected (banner, form, checkbox, etc.)
Warning: Failure to store consents can result in significant penalties. In case of inspection, you must be able to demonstrate that each consent was legitimately obtained.
Consentio automates the collection and archiving of all consents, generating a complete audit-proof registry, always available for inspections.
Penalties for Non-Compliance
Failure to comply with GDPR regulations and Data Protection Authority guidelines can result in very severe administrative penalties. Fines can reach up to 4% of the company's annual global turnover or up to 20 million euros, whichever is greater.
Maximum penalty: Up to 20 million euros or 4% of annual worldwide turnover, whichever is higher.
Examples of penalties in Italy
- Missing cookie banner: Penalties from €10,000 to €120,000
- Cookies installed without consent: Penalties from €6,000 to €36,000 per violation
- Inadequate privacy notice: Penalties from €6,000 to €36,000
- Failure to record consents: Penalties up to €20,000,000 or 4% of turnover
- Non-compliant extra-EU data transfer: Penalties up to €20,000,000 or 4% of turnover
Don't risk penalties that could cripple your business. GDPR compliance is not optional, it's a legal obligation. Consentio helps you become compliant in minutes.
Google Consent Mode v2
Starting from March 2024, Google requires all websites using Google services (Analytics, Ads, Tag Manager) to implement Consent Mode v2. Without this implementation, conversion and analytics data may be lost.
What is Consent Mode?
Google Consent Mode is an API that allows you to communicate the consent status of users to Google. Based on the consent obtained, Google adapts the behavior of its tags and services, ensuring user privacy is respected.
From March 2024: Google requires the implementation of Consent Mode v2 to continue collecting conversion and remarketing data in the European Economic Area (EEA) and the United Kingdom.
Consent Mode v2 Parameters
- ad_storage: Controls the use of cookies for advertising
- analytics_storage: Controls the use of cookies for analytics
- ad_user_data: Controls sending user data to Google for advertising
- ad_personalization: Controls ad personalization