ICTRecht - Header - STAAND - Algemeen (5)

    What are cookies and why are they legally relevant?

    Cookies play a central role in how websites function, track visitors, and collect information. Precisely because cookies can deeply intrude into users' personal lives, European legislation imposes strict requirements on them. For organisations, this means that cookie usage is not only a technical responsibility, but above all a legal one.

    Download the factsheet Contact

    Everything about cookies

    In this factsheet, we describe what cookies are and the legal rules that apply to them. As tracking cookies are the most heavily regulated, this factsheet focuses on tracking cookies.

    Download now
    Voorkant van factsheet cookies

    What exactly are cookies?

    Cookies are small files that a website owner places on a visitor's device. For example, on a computer, laptop, smartphone, or tablet. This allows the website owner to track the website visitor and collect or store information about the website visit or about the visitor (or their device).

    What types of cookies are there?

    Three main categories of cookies are distinguished:

    1. Functional cookies: Cookies used to ensure a website or app functions properly, and which are therefore technically necessary to guarantee the quality and effectiveness of the website's operation.
    2. Analytical cookies: Analytical cookies are intended to improve the use of the website/app and their services. These cookies collect information about visitor numbers, clicks on links and videos, and on which devices the website or app is visited.
    3. Tracking cookies: A cookie can be classified as a tracking cookie if its purpose is to map (individual) visitors and their browsing behaviour, and through which personal data is therefore processed.

    L1853383

    Who is subject to the cookie rules?

    Consent is required as soon as cookies are not strictly necessary for the functioning of the website. This includes not only website owners, but also software vendors, advertising platforms, and other parties in the cookie ecosystem. Outsourcing does not exempt parties from their own responsibility.

    When is cookie consent required?

    Consent is mandatory whenever cookies are not strictly necessary for the functioning of the website. Prior, freely given, and informed consent is required, particularly for tracking cookies. Cookies may not be placed or accessed before such consent has been obtained.

    Frequently asked questions about cookies

    If we only place cookies without reading them, are we processing personal data?

    Processing of personal data does not only occur when cookies are read for advertising purposes. Storing data in a cookie is already sufficient. Processing also includes placing tracking cookies, which are then automatically 'filled' with personal data as soon as someone visits the relevant website, with the purpose of reading this data later.

    Does processing a cookie ID count as processing personal data?

    This is an incorrect assumption. Apparently, there is a belief that a cookie ID alone would be insufficient to directly identify a natural person. However, according to the GDPR and established case law, a cookie ID is considered personal data. A cookie ID is an online identifier that is also transmitted along with the internet user's IP address. This links data of individualized data subjects to an 'identifier' and records it for further processing.

    Who in the cookie ecosystem is responsible for obtaining consent?

    In the chain, obtaining consent is usually left to the partners, as they operate the websites that internet users visit. However, all chain partners and their website partners are to be regarded as joint controllers within the meaning of Article 26 GDPR, and data subjects are free to exercise their rights under the GDPR against each individual chain partner.

    How can software providers comply with cookie legislation?

    As a software provider, you can make tools available to partners that make it impossible to place tracking cookies without consent, and ensure that this actually leads to a corresponding practice (privacy by design and default).

    What steps are needed to use analytics tools like Google Analytics in a privacy-friendly way?

    For analytical cookies, you can take precautionary measures to minimise unwanted consequences for website visitors. These measures include:

    • Applying privacy-friendly settings. For example, according to the Dutch Data Protection Authority's Guide for Google Analytics, by:

      • following steps 1 to 4 from the guide;
      • configuring Google Analytics in a privacy-friendly manner according to the step-by-step plan.

    • Concluding a data processing agreement with the service provider ((sub)processor), which includes, among other things, that the last octet of the IP address is masked.
    • Ensuring that no user IDs are linked to IP addresses.
    • Ensuring that (sub)processors are not permitted to use the (masked) IP addresses for their own services.
    • Guaranteeing that (sub)processors are not permitted to use the (masked) IP addresses for their own services. Informing users in the privacy/cookie statement that such a cookie service is being used and that steps 1 to 4 from the Dutch DPA's Guide have been applied.

    • Informing visitors upon their first visit about the use of functional and analytical cookies.

    Would you like more information?

    Submit your details using the form and one of our legal advisors will contact you. Good to know: we always start with a no‑obligation consultation, by phone, at our office, or at your location.

    Leave your details