EDPB adopts final report of outcome of the cookie banner task force

Coordinated action at the European level

Between May 2021 and August 2022, 18 data protection authorities in the European Union and the European Economic Area (EEA), including the CNIL, received several hundred complaints from the NOYB association regarding the design and characteristics of cookie banners.

In reaction, a task force bringing together all voluntary European data protection authorities was created to collectively analyze the various issues raised by these complaints, even though the cooperation mechanism provided for by the GDPR (the "one-stop shop" mechanism) does not apply to the reading and/or writing of information in users' terminals.

Indeed, even if the storage of cookies and other tracking devices is specifically covered by the ePrivacy Directive (Article 5(3) - transposed into the French Data Protection Act in Article 82), the EDPB considered that the number of complaints and countries concerned, as well as the importance of the subject for the protection of Internet users' privacy, justified a certain coordination at European level.

The main points of attention that were discussed were the modalities of acceptance and refusal to the storage of cookies and the design of banners.

The CNIL coordinated this work with the Austrian authority. 13 working meetings took place and led to the adoption of a report presenting the conclusions of the analyses carried out.

This report notably states that the vast majority of authorities consider that the absence of any option for refusing/rejecting/not consenting cookies at the same level as the one provided for accepting their storage constitutes a breach of the legislation (Article 5(3) of the ePrivacy Directive). The CNIL had already taken such a position in its guidelines and in the context of several sanctions.

With regard to the design of the banners in particular, the authorities concluded that the information provided must enable Internet users to understand what they are consenting to and how to express their choice.

The authorities agree that they cannot impose a standard in terms of color or contrast on all websites. A case-by-case review of the banner must be done to determine if the design chosen (e.g. color/contrast) is not obviously misleading to users.

This work and the elements on which harmonized positions have been reached will enable the authorities to finalize the handling of the complaints they received.

The report summarizing the analyses and conclusions of the task force is available on the EDPB website.