Cookie opt-in instead of cookie opt-out
This approach, i.e. a cookie opt-out function, is no longer permitted according to the latest ruling by the Federal Court of Justice. Accordingly, cookies may only be used if the user expressly gives their consent by setting checkboxes and clicking on an "Agree" button - cookie opt-in function.
However, there are also exceptions and gray areas here, which neither the EU Cookie Directive nor the GDPR address. What is certain is that so-called "essential" cookies, which ensure the technically smooth operation of a website, do not require consent. This includes, for example, the language selection of a website, the login status on an online portal or the shopping cart cookie for online stores.
The EU ePrivacy Regulation defines the necessity of a cookie "[...] if the sole purpose is to carry out or facilitate the transmission of a communication over an electronic communications network or [...] to provide an information society service explicitly requested by the subscriber or user."
Web tracking via Google Analytics or Facebook Pixel
But what does this mean for the role of third-party cookies - for example Google or Facebook? Data storage solely for the purpose of advertising and market research falls under the legally prescribed consent requirement. The same applies to the creation of user profiles, the analysis of user behavior or conversion measurement.
Although analysis tools such as Matomo and Google Analytics can be used without cookies, as the data is stored on a separate server or processed strictly separately from other services, this is a legal gray area. The legal situation leaves some questions unanswered here, so that the opt-in variant with cookies definitely seems more sustainable.
In contrast, the case of general web tracking is far less specific. By measuring visitor flows on their own website, operators often draw important conclusions about its functionality, which can be tantamount to a technical necessity. An opt-out function therefore remains permissible here too, even if further legal adjustments are to be expected in the future.
Remarketing & web tracking: What do customers need to consider now?
Numerous companies and websites in Germany and the EU do not yet comply with the legal requirements of the new cookie policy. In order to avoid the risk of fines, it is therefore recommended that the new guidelines are implemented promptly. If the decision is made to only use technically necessary cookies in the future or to continue to do so, companies are not affected by the consent requirement on their website.
In future, all others will have to obtain the user's consent - by clicking (i.e. explicitly) - in the form of a cookie opt-in banner. Until this happens, only necessary cookies may be set! It should also be noted that consent fields may not be pre-filled and that the user is informed in detail about the type of data processing and the storage period. In order to ensure maximum transparency, it is also necessary to explicitly name the third-party services used (e.g. GA, E-Tracker, Matomo, Facebook Pixel) in the wording.
Meanwhile, there is no requirement for the placement of banners, although an opt-in field in the middle of the screen may be more likely to result in consent than one at the bottom of the screen. An admittedly more radical step in the form of a "cookie wall" is also conceivable: This only grants users access to the content of the page if they also give their permission to use the data. What all solutions have in common is that any consent given by a user can also be revoked on the website - for example in the privacy policy.
Web development from the perspective of the Internet agency .FUF
What will change for an internet agency like Frank und Freunde? For numerous web projects, .FUF is not only responsible for the creative implementation but also the technical development. In addition to setting up the corresponding content management system (e.g. Drupal or TYPO3), .FUF also has to integrate external services via an interface in accordance with the customer's requirements.
As a rule, the integration of tracking tools such as Matomo, Google Analytics, etracker or Facebook Pixel are common tasks for new and existing projects. The extent to which these are used ultimately determines the extent to which the cookie notices need to be adapted. The new legal situation therefore also requires new solutions for future-proof remarketing - via Facebook, Google and the like - as well as consent-independent web analytics.
As a Stuttgart-based Internet agency, .FUF advises its clients and tries to find the best possible individual solution for the various websites. In addition to the technically clean use of cookies, the focus is on the correct placement of banners and the correct formulation of their use. The ultimate aim is to avoid negative effects for website operators while at the same time complying with legal requirements.
In the context of the new jurisdiction, Frank und Freunde has already implemented the cookie banner of our long-standing client - the Baden-Württemberg Chamber of Architects - in accordance with the requirements.