Cookies – what they are and what applies to consent

Almost all websites today use cookies, but the rules for how they may be used can feel complicated. In this article we explain what cookies are and how they affect the user experience. We also take a look at what is good to consider regarding consent.

What is a cookie?

A cookie is a small text data file that the website saves on the visitor's computer. When you as a user browse to a website, your browser stores cookies to see how you navigate and use the site. They are often used for technical reasons to give you access to necessary functions that can improve the user experience. For example, a cookie can remember your login details, language choice or what you have put in the shopping cart. As a user you don't have to repeat your choices and settings. The webpage also does not need to be reloaded and loading times are improved. In addition to making the website work optimally, cookies are used to collect statistics about visitors' behaviour and activities, often with the aim of tailoring marketing and advertising.

Different types of cookies

There are generally two main types of cookies, permanent and session-based. In addition to these there are also third-party cookies.

• Permanent cookies – are stored on your computer or mobile device for a longer period, until a certain date. When the expiration date has passed the cookie is deleted from your computer and recreated the next time you visit the website. You can also choose to delete them yourself.
• Session cookies – are temporary cookies that are stored in your browser while you visit a website. They disappear as soon as you close the page. For example, to remember a language choice.
• Third-party cookies – come from a different website than the one that placed the cookie on the user's computer. This type of cookie is intended to collect statistics about visitors' activity on the web. For example, it is used for advertising and tailored content. Visitors' browsing habits can also be tracked on other websites that use the same advertising or analytics service. This is one of the reasons why it is considered more sensitive from a privacy perspective.

What does consent to the use of cookies mean?

Most of us probably recognize cookie pop-ups and banners that appear as soon as you visit a new website. Often you have been asked to accept cookies via a pre-ticked box, or you may have seen text like the following:

“If you continue browsing the website
you accept that we use cookies”

The EU Court has now decided to further tighten the handling of cookies. It now requires active consent from website visitors regarding the use of cookies. A pre‑ticked box or text informing that you accept cookies by continuing to browse does not constitute valid consent. This applies regardless of whether the information handled by a cookie constitutes personal data or not. For companies and organizations, this means they must review their use of cookies and how they obtain consent

There are, however, exceptions for consent for cookies that are necessary, that is necessary to provide a service that the user has explicitly requested to use. For example, this may apply to a cookie used to save the contents of a shopping cart. Non‑necessary cookies therefore do not require active consent

Tips for you who have a website

To more easily keep track of your cookies and present them to visitors in an understandable way, you can start by categorizing them. Review which cookies you use and whether you really need them. Then design the consent in accordance with the GDPR. Broadly speaking, this means that the user must be able to perform an active, specific and informed action for the consent to be valid. That brings us to the next part – giving consent.

Giving consent to cookies – some rules and guidelines

Cookies give websites the opportunity under certain conditions to map and analyze the information you leave behind when you browse the web. The new rules regarding consent aim to protect you as a user and your personal privacy. There is no ready-made template for how consent should be obtained. It is up to each website owner to develop and adapt it to their site. There are, however, some rules to adhere to:

• The most important thing is that visitors are given the opportunity to give their consent voluntarily, individually and specifically for the particular purpose
  
  A voluntary consent means that it must be an active action where the visitor must give their approval before cookies are used or stored. An individual and specific consent means that the visitor should be given the opportunity to approve or refuse each specific purpose for which cookies are used
  
  A general consent is therefore not accepted. To be able to offer visitors this choice, some form of control panel or cookie page is required where they can manage their settings. Consent must therefore include at least two options: to accept or not accept
• As a website owner, you are under the cookie law obliged to inform your visitors that the website uses cookies and what the purpose of the cookies is
• Whether or not the cookie collects personal data, consent must be obtained in accordance with the GDPR
• It must always be accessible and clear to the user where and how they change their consent and acceptance choices. You must therefore ensure that users can withdraw their consent

3 Cookie examples you should not use:

• Allowing the user to automatically accept cookies without making an active choice, for example if they continue to use the website, is not considered valid consent
• Using a pop-up where the user can only choose to accept cookies is also not considered a voluntary choice. The user must be able to choose not to accept non‑necessary cookies
• It is also not valid consent if you inform the user that the website uses cookies and only offer an OK button, if cookies have already been set. For example ”This website uses cookies. OK” 

Using the site without cookies

If a user chooses not to accept cookies the site should still be usable. Functionality that collects or processes personal data should then not be available. However, you should be clear that certain functionality will be missing and that this can lead to a more stripped-down web page. Even if the visitor has once accepted the cookie terms it must always be accessible and clear to the user where and how to change their consent choice

Cookie management with ready-made tools

If your company does not want to spend time and money developing control panels to manage cookie settings there are a number of different ready-made tools. You may simply want to avoid reinventing the wheel. Before choosing a tool it can be good to check how it works — does it have all the required functionality? Can the tool be customized? In some tools you can, for example, customize the CSS so that the appearance and colour choices can follow your own graphic profile

One of the toughest challenges is to map and categorize all the cookies that are set on a website. A strong argument for using a third-party service, such as Cookiebot, is that it can:

• Scan the site for cookies
• Map the cookies it finds
• Categorize all cookies it recognizes

In this way you reduce the risk of missing cookies that you might not even be aware are being set

Summary

• Cookies contain information about how users browse and use a website. In this way, companies can learn about their customers' behaviors, tailor the experience and create relevant content.
• For visitors, cookies can provide a better user experience, for example through personalized content and faster-loading pages.
• Visitors must be given the opportunity to give their consent voluntarily, individually and specifically for the relevant purpose. A blanket consent is therefore not acceptable.
• The new regulations regarding consent are designed to protect you as a user and your personal privacy. This may mean your website will require a number of measures regarding how you handle cookies and consent.

Do you need to review your cookie management or improve something else in the digital customer journey? Don't hesitate to contact us and we'll help you!

Also read