Archives: Cookies, Tracking & Online Behavioral Advertising

Subscribe to Cookies, Tracking & Online Behavioral Advertising RSS Feed

Cookies: CNIL provides clarification on its position through three major decisions impacting worldwide online service providers

By Daniel Kadar, Stéphanie Abdesselam and Laetitia Gaillard on Posted in Cookies, Tracking & Online Behavioral Advertising
The French data protection authority (CNIL) rendered three major decisions impacting worldwide online service providers following online controls and investigations performed on the companies’ websites. These decisions highlight the obligations of data controllers when using cookies and other trackers, notably regarding the way the user’s consent shall be collected, and the level of information that … Continue Reading

EDPB updates consent guidance to clarify its position on consent to the use of cookies

By Cynthia O’Donoghue, Katalina Bateman and Sarah O'Brien on Posted in Cookies, Tracking & Online Behavioral Advertising
On 4 May 2020, the European Data Protection Board (EDPB) adopted an updated set of guidelines on consent (Guidelines) under the General Data Protection Regulation (GDPR). These updates were made to the original guidelines published by the Article 29 Working Party on 10 April 2018, which the EDPB endorsed at its first plenary meeting on … Continue Reading

The 7-Step Ad Tech Guide – New guidance issued by industry bodies on programmatic advertising

By Cynthia O’Donoghue and Nadia Avraham on Posted in Cookies, Tracking & Online Behavioral Advertising
The Data & Marketing Association and the Incorporated Society of British Advertisers have published a “Seven-Step Ad Tech Guide” (the Guide) to help address the privacy challenges of Real Time Bidding (RTB) in programmatic advertising. RTB is an automated auction process that allows advertising space to be bought and sold on a per-impression basis. When … Continue Reading

#Ad #Germany – Update for influencers

By Margarita Trukhina, Ramona Kimmich and Dr. Alexander Hardinghaus on Posted in Cookies, Tracking & Online Behavioral Advertising, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)
On February 13, 2020, the German Federal Ministry of Justice and Consumer Protection (BMJV) published a proposal to soften the regulatory requirements for influencers for labeling their posts as advertising (Proposal). Under the Proposal, statements posted on social media about products for which no consideration was given – either in the form of monetary compensation or other … Continue Reading

It’s time to reassess cookie compliance in France

By Daniel Kadar and Stéphanie Abdesselam on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Regulatory
Companies have been challenged with respect to their cookie policies and their implementation due to the entry into force of the GDPR earlier than the proposed ePrivacy Regulation  Given the delay in the adoption of an EU-wide regulation on e-privacy, national data protection authorities have taken the initiative in publishing guidelines on cookies requirements. The … Continue Reading

2020 could be a monumental year for adtech

By Elle Todd, Keri S. Bruce and Sarah Bruno on Posted in Cookies, Tracking & Online Behavioral Advertising, Data & Cyber Security, Privacy & Data Protection, Regulatory
With the California Consumer Privacy Act (CCPA) coming into effect on January 1 and the announcement on 14 January from Google that it will be phasing out third party cookies within the next two years, it seems that 2020 will be a significant year for the adtech industry as industry players react with solutions and … Continue Reading

Updated draft of ePrivacy Regulation – Finnish presidency of the Council of the EU aims for final text by the end of the year

By Sven Schonhofen, Dr. Thomas Fischl and Arne Senger on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
The Finnish presidency of the Council of the EU (Finnish Presidency) released an updated draft of the Regulation on Privacy and Electronic Communications (ePrivacy Regulation) on October 30, 2019 (available here). The Working Party on Telecommunications and Information Society (WP TELE) will discuss the new draft at its meeting on November 7, 2019. Amendments put … Continue Reading

Compliant use of cookies in the EU is still a secret recipe: ECJ decides on Planet49, but does not provide clarity

By Dr. Andreas Splittgerber, Cynthia O’Donoghue, Ramona Kimmich and Daniel Millard on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
In its judgment of 1 October 2019, the European Court of Justice (ECJ) decided on cookie consent requirements under the General Data Protection Regulation 2016/679/EU (GDPR) and the Cookie Directive 2002/58/EC (Cookie Directive) (Case C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V. (the Judgment)). The ECJ set clear requirements on what cookie … Continue Reading

Update on ePrivacy Regulation: “Current draft does not guarantee high level of protection and cannot be supported”, German government states

By Arne Senger, Friederike Wilde-Detmering and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
In its response dated 3 July 2019 (Response; file no. 19/11351, available in German here) to an inquiry by members of the German parliament (Inquiry), the German government took stand on the current draft Regulation on Privacy and Electronic Communications (ePrivacy Regulation), and particularly on “tracking”. The German government summarises its assessment of the ePrivacy … Continue Reading

Check your compliance to the updated ICO guidance on cookies

By Elle Todd on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection
On July 3, 2019 the Information Commissioner’s Office (ICO) published an updated guidance on the use of cookies. Although the guidance confirms requirements of which most data practitioners already comply, it outlines steps for non-compliant companies. Now that the ICO has confirmed its regulatory expectations and detailed immediate enforcement, companies need to take action to … Continue Reading

Advocate General’s opinion on social networks’ obligations on (worldwide) deletion of illegal content

By Sven Schonhofen and Friederike Wilde-Detmering on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection
“The internet’s not written in pencil, it’s written in ink.” Advocate General (AG) Szpunar commenced his opinion dated 4 June 2019 in Case C-18/18 (Opinion, available here) with the above quote from the movie The Social Network. In the Opinion the AG analysed the substantive scope of injunctions, in particular if social network providers “may … Continue Reading

ICO investigates adtech awareness through fact finding forum

By Cynthia O’Donoghue and Eleanor Brooks on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection
The Information Commissioner’s Office (ICO) recently published a summary report of its fact finding forum on data protection issues arising from advertising technology (adtech). Adtech is a term commonly used to refer to all technologies, software and services used for delivering and targeting online advertisements. The ICO compiled responses from over 2,300 participants in an … Continue Reading

Planet49: Advocate General’s opinion on cookies and consent bundling

By Cynthia O’Donoghue and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
On 21 March 2019, Advocate General Maciej Szpunar (“AG”) delivered an opinion on cookie consent, information obligations regarding cookies and consent bundling (Case C-673/17, Planet49 GmbH v. Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.). In the case at issue, users entering into a promotional lottery were confronted with two checkboxes: A checkbox obtaining … Continue Reading

UK regulator to focus on ad-tech

By Cynthia O’Donoghue and John O'Brien on Posted in Cookies, Tracking & Online Behavioral Advertising
On 6 March 2019, the Information Commissioner’s Office (ICO) will host a fact-finding forum in central London. The aim of this forum is to facilitate a dialogue between ad-tech stakeholders. The ICO wants to understand the complexities of ad-tech practices. Why ad-tech? ‘Ad-tech’ is the product of technology’s transformation of the advertising industry. It uses … Continue Reading

German supervisory authority audited 40 websites on the use of tracking tools – and none of them was compliant

By Dr. Philipp Süss, Dr. Thomas Fischl, Dr. Andreas Splittgerber and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)
The Bavarian Data Protection Authority (‘Bavarian DPA’) audited major Bavarian websites for their use of tracking tools on Safer Internet Day. It calls its findings “desolate”. None of the tracking tools were implemented in a compliant manner. Audit by the Bavarian DPA Tracking and the requirements for using cookies have been a highly debated topic … Continue Reading

First sanction decision rendered by the CNIL under the GDPR: GDPR awareness 2.0 has begun

By Daniel Kadar and Laetitia Gaillard on Posted in Big Data, Cookies, Tracking & Online Behavioral Advertising, Global Data Transfers, Privacy & Data Protection, Regulatory
In an interview dated February 2018,[1] Isabelle Falque-Pierrotin, at the Head of the French data protection authority (CNIL), stated that the CNIL would adopt a flexible and pragmatic approach from May 2018 onwards when controlling compliance with data protection requirements. The first decision of sanction rendered by the CNIL on Monday January 21, 2019, which … Continue Reading

ICO warns that the Washington Post offers invalid cookie consent under the GDPR

By Cynthia O’Donoghue and John O'Brien on Posted in Cookies, Tracking & Online Behavioral Advertising
It has been reported that the Information Commissioner’s Office (ICO) has issued the US-based Washington Post newspaper with a warning about how it obtains consent for cookies from website visitors. According to a report in The Register, the ICO stated that the Washington Post’s online subscription options do not allow users to opt out of … Continue Reading

German State Media Authorities issue new guidance paper on marking adverts on social media

By Dr. Philipp Süss, Dr. Alexander Hardinghaus and Ramona Kimmich on Posted in Cookies, Tracking & Online Behavioral Advertising, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)
Recently, the German media regulators, the State Media Authorities (Landesmedienanstalten), issued a joint guidance paper on marking adverts on social media, which is available in German language here (Leitfaden der Medienanstalten, Werbekennzeichnung bei Social Media-Angeboten; “Guidance Paper”). The Guidance Paper replaces the State Media Authorities’ earlier FAQs. It is intended to help organisations and individuals … Continue Reading

Update on Facebook fan pages: What should organisations do after the release of Facebook’s co-controller agreement?

By Dr. Andreas Splittgerber, Sven Schonhofen and Dr. Thomas Fischl on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
After another statement by the German Data Protection Authorities (German DPAs) of 5 September 2018 (Statement, available in English here), stating that the operation of a fan page as offered by Facebook was illegal, Facebook reacted “overnight” and released a co-controller agreement, the “Page Insights Controller Addendum” (Insights Addendum, available here). In a press release … Continue Reading

Proposed amendments to the ePrivacy Regulation

By Cynthia O’Donoghue and John O'Brien on Posted in Cookies, Tracking & Online Behavioral Advertising, Regulatory
On 10 July 2018, the Council of the European Union has published a draft of revisions to the proposed ePrivacy Regulation (ePR). The ePR is likely to come into force in 2019. The ePR will repeal and replace the Privacy and Electronic Communications Directive 2002/58/EC. The ePR will align Europe’s ePrivacy regime more closely with … Continue Reading

How big is the risk to operate Facebook fan pages in Germany?

By Dr. Andreas Splittgerber, Dr. Thomas Fischl and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
On 5 June 2018, the Court of Justice of the European Union (CJEU) handed down its long-awaited Facebook fan page judgement (Case C-210/16), holding that the operator of a fan page on Facebook is jointly responsible with Facebook for processing the data of visitors to the page. Only a day later, the Conference of German … Continue Reading

German authorities: tracking and profiling cookies require opt-in consent

By Dr. Andreas Splittgerber and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)
On 26 April 2018, the Conference of German Data Protection Authorities (German DPAs) released a highly criticised position paper on the applicability of the German Telemedia Act (TMA) after 25 May 2018 (Position Paper, available in German here). The Position Paper clearly states that tracking and profiling cookies now require informed prior opt-in consent. Position … Continue Reading

Territorial applicability of the GDPR

By Sven Schonhofen and Friederike Wilde-Detmering on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection
The GDPR is just around the corner and will be effective in less than three months – on 25 May 2018. Organizations are therefore in the midst of preparations to comply with the new Regulation in order to avoid the potentially high fines. Non-EU organizations have to assess whether the GDPR is applicable to them … Continue Reading

Sears Petitions to Change Its 8-Year-Old FTC Privacy Settlement Order

By Wendell Bartnick on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection
On October 30, 2017, Sears Holding Management Corporation (“Sears”) petitioned the Federal Trade Commission (“FTC”) to reopen and modify the settlement to which they agreed in 2009.  At that time, Sears agreed to a consent order to resolve the FTC’s complaint that Sears allegedly did not adequately disclose the scope of its collection of “online … Continue Reading
LexBlog