EDPB Guidelines Clarify Scope of EU “Cookie” Notice and Consent Requirements

The European Data Protection Board (EDPB) has recently published new guidelines to clarify the scope of the EU “cookie” notice and consent requirements. These guidelines, released on November 16, 2023, aim to provide a better understanding of Article 5(3) of the ePrivacy Directive, which is known for establishing the rules around cookie notices and consent in the EU.

Article 5(3) of the ePrivacy Directive goes beyond just cookies and covers the storing and accessing of information on a user’s device, requiring clear and comprehensive consent from the user. The EDPB’s Guidelines 2/2023 delve into the technical aspects of this directive, analyzing components such as information, terminal equipment, electronic communications network, gaining access, and stored information and storage.

One key clarification from the EDPB is that the scope of Article 5(3) includes both personal and non-personal data, regardless of how it is stored or by whom. Additionally, the definition of terminal equipment is broad and can include devices used by multiple users, such as smartphones, laptops, connected cars, and smart glasses.

The EDPB also highlights that the requirement for consent applies to various tracking technologies beyond just cookies, such as tracking pixels, tracking links, device fingerprinting techniques, and certain types of local processing. The Guidelines are currently open for public consultation until December 28, 2023.

For more information, you can read the full Guidelines on the EDPB’s website and the accompanying press release. Stay informed on the latest developments in data protection and privacy regulations in the EU.