La Directive E-Privacy: opt-In ou opt-out pour l’usage des « cookies » ?

Belgian law is expected to implement the amended European E-Privacy Directive (2009/136/EC) by the end of May 2011. The most important innovation in the Directive is that the use of ‘cookies’ may now require the  explicit and prior consent of the website user.

Cookies are small electronic files embedded in websites and stored on the visitor’s computer. They enable certain functionalities such as authentication and storing site preferences (including languages). Cookies are also used by advertisers for tracking and marketing purposes.

Currently, an “opt-out” system applies, whereby a cookie can be stored on a user’s computer where:

(a) the user is provided with clear and comprehensive information about the purpose of the cookies; and
(b) the user has been given the opportunity to refuse the use of cookies.
The new “opt-in” system of the Directive has caused much uncertainty regarding the nature of the consent to be given for the use of cookies by website visitors. Will the user's consent to the use of cookies be assumed through browser settings alone? Or will a pop-up be needed to obtain the user's consent?

The Directive has been strongly criticized by website operators, who fear that the wording of the Directive regarding consent will lead to national legislation that requires permission to store cookies each time a visitor accesses a web-site. The advertising industry also expressed concern regarding the ability to target consumers with specific ads and to track consumer behaviour. However, all is not lost. Under the new rules, consent is not required when the cookie is ‘strictly necessary’ to deliver a service that has been explicitly requested by the user, for example where a cookie takes the user from a product page to the payment page.

In addition, Recital 66 of the Directive states that, where it is technically possible and effective, the user’s consent to the use of cookies processing may be assumed throug the use the appropriate browser settings or other applications. This may see website operators and online advertisers having a sigh of relief.

The press has obtained a confidential report by the European Commission, offering guidance to EU Member States tgat are implementing the Directive. The document states “[t]here is no language at all endorsing any kind of ‘opt-in’ clause, which would force users to give their consent explicitly before cookies are placed on their computer. Settings of a browser or another application are sufficient.”

The document also states "[i]t is not necessary to obtain consent for each individual operation of gaining access to or storing of information on a user's terminal, if the initial information and consent covered such further use."

The document recommends self-regulation by the industry. "The Commission considers that the industry is well placed to design innovative technical solutions," the document says.

It is not known unknown how the Belgian legislature will implement the Directive. The implementation of the Directive should be completed by 25 May 2011.