1. What is meant by cookies and do they always qualify as personal data?
Cookies are small text data files that are stored on the end device – such as a computer or smartphone – or in the browser when a website is accessed in the internet browser. These text files can be collected and retrieved by the web server of such a website. There are different types of cookies. They can be grouped according to their lifetime (e.g. session cookies and persistent cookies) or by the domain to which they belong (e.g. first-party and third-party cookies).
Cookies, or rather: the information contained in cookies, do not qualify per se as personal or non-personal data according to Art 4 no 1 GDPR. It always depends on the circumstances of the individual case, in particular which information is contained in the cookies and in which way this information can be combined.
A website that is offered in five different language versions can be mentioned as an example. The user is given the option of selecting the "German" language version the first time he or she accesses the website. When this selection is made, a text file (a cookie) is stored on the end device together with the information that the user wants to use the website in the German language. If this information (i.e. the selection of the German language setting) cannot be linked to the user, it is a non-personal data. However, if the website operator can link the language setting to the user, for example because the user has registered in the website's online store, this is undoubtedly a personal data. Cookies may also contain universally unique identifiers (UUID). In brief, these are user-specific identifiers with which users' end devices are marked. The GDPR refers to online identifiers in accordance with recital 30. It is indeed the case that such an online identifier is basically only a marking of an end device. However, there are many ways to associate an end device to a specific person, for example, when a person registers on the respective website or fills out a contact form. In some cases, such an online identifier, together with associated user information, can be can also be associated with a profile on a social media platform (see in this regard the decision of the Austrian DPA of December 22, 2021, D155.027, 2021-0.586.257 not legally binding yet).
2. Legal framwork for the use of cookies in Austria
The permissibility of placing or collecting cookies is generally governed by Art 5 para 3 of the Directive 2002/58/EC, as amended, which was implemented into Austrian law in § 165 para 3 TKG 2021.
In general, it can be said that cookies may only be placed or collected without consent when visiting a website if this is absolutely necessary in order for the provider of an online information society service, which has been expressly requested by the user, to be able to provide this service ("technically necessary cookies").
For all "technically unnecessary cookies" consent must be obtained. When creating a website, it is urgent to ensure that no "technically non necessary cookies" are set before obtaining consent. The conditions for such consent are based on Art 4 Z 11 and Art 7 GDPR.
3. When are cookies "technically necessary"?
For the use of "technically necessary cookies" it is not necessary to obtain the consent of the website user. Neither the Directive 2002/58/EC nor the Austrian TKG 2021 contain a specific list of what is meant by "technically necessary cookies". However, the Opinion 04/2012 on Cookie Consent Exemption, WP 194, 00879/12/EN of the former Art 29 Working Party contains criteria for assessing whether cookies as defined in Art 5 para 3 of the Directive 2002/58/EC, as amended, are necessary from a technical perspective. The Austrian DPA advises to use the recommendation of the former Art 29 WP in case of doubt. From the perspective of the Austrian DPA, the following services are necessary from a technical point of view (and corresponding cookies can therefore be set without consent):
- necessary session management (such as cookies to store the shopping cart as part of an online purchase or cookies to store the login status)
- inputs in an online form, if an input over several subpages of a website is necessary to submit the form
- the information about the consent status, unless a unique online identifier is assigned for this purpose.
From a technical point of view, services that are not necessary (and therefore in need of consent) are in particular those that, for example, record and evaluate the user behavior of individuals on the respective website or across multiple websites or end devices. According to the Austrian DPA, this includes in particular plug-ins of social media services or advertising networks that result in the transfer of personal data of website users to third parties. Based on Austrian case law, Art 5 para 3 of the Directive 2002/58/EC, as amended, is not to be interpreted in the sense of an "economic necessity".
This means that advertising cookies for displaying personalized advertisement do not become "technically necessary" merely because the display of personalized advertisement is necessary to finance the operation of the website (see in this regard the decision of the Federal Administrative Court of March 12, 2019, W214 2223400-1).
4. The design of a cookie-banner
Website users should be informed about cookies in a comprehensible manner and give their consent to the storage of certain cookies. So called cookie banners, which are displayed as an overlay when a website is visited for the first time, are particularly suitable for this consent.
In principle, it is open to the website operator to design the cookie banner according to his ideas. However, it should be noted that the conditions for consent are based on Art 4 no 11 and Art 7 GDPR.
Consent for the setting and collecting of "technically unnecessary" cookies and for the subsequent data processing is therefore only effective if the relevant requirements of the GDPR are fully complied with.When designing the cookie banner, the following should be taken into account:
- First consent, then cookies: Consent must be obtained in advance. When establishing a website, it is imperative to ensure that no "technically unnecessary cookies" are set prior to obtaining consent.
- Awareness of the data subject It must be clear to the data subject that he or she is giving consent. Continuing to surf without interacting with the cookie banner or a "hidden consent button" that is selected by mistake cannot be interpreted as unambiguous consent. Likewise, consent cannot be assumed solely because a data subject generally permits the setting or collecting of cookies in the browser settings.
- Privacy by default: The data subject must proactively opt in. Pre-settings or pre-ticked boxes in the cookie banner are not permitted.
- Voluntary: Consent must be given voluntarily. The data subject must not be threatened with any disadvantages and must not suffer any disadvantages if he or she does not give consent. In principle, it is inadmissible to deny the data subject access to the website in the event that he or she does not give consent.
- Possibility of revocation: The cookie banner must clearly describe where or how consent can be revoked. The revocation must be as simple as the granting of consent.
- Fulfillment of the duty to inform: It must be clear to the data subject what the consent is being given for. This requires that the information requirements are fully met.
- Failure to give consent is as simple as giving consent: It should be as easy to refuse consent (or to continue browsing without consent) as it is to give consent. In other words There should be no more actions required with the cookie banner for not giving consent than there are for giving consent. The data subject cannot be required to make the decision not to give consent on a button only at a second or third level.
- No unfair practices: The data subject must not be directly or subtly urged to give consent (no "nudging"). It is not permissible to design or position the button for not giving consent (or to continue surfing without consent) in such a way that this button is less visible than the button for giving consent.
5. Exekutive Summary and recommended action
A website operator who has made the decision to use cookies or other services on his or her website is qualified as a controller in accordance with Art 4 no 7 GDPR or even a joint controller pursuant to Art 26 GDPR. However, the pre-condition is that personal data is processed. It does not matter whether the cookies on the website are sent from the web server to the website users browser or whether there is simply a java script code built into the website that generates cookies in the browser. Similarly, it does not matter whether the website operator has access to the personal data or not (for example, access to the website user's interest profile created by the advertising network). If cookies or other services are installed on the website for personal interest (for example, in order to earn money by playing out personalized advertising) and personal data is processed in the process, the website operator is, in the opinion of the Austrian DPA (at least to a certain extent) in any case the data controller under data protection law.
Based on the high penalty framework of the GDPR, a website operator will be required to comply with the data protection requirements and to inform the data subject about the cookie placement as well as to obtain consent for cookies that require consent.
Article provided by INPLP member: Clemens Thiele (Götzl Thiele EUROLAWYER® Rechtsanwälte, Austria)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP
