The Belgian Data Protection Authority just published a “cookie checklist” with its position on a number of issues regarding cookies. I’m attaching an unofficial machine translation (losing lots of its layout too), but here are some first thoughts:
– Some of these topics might be subject to litigation, so while they may reflect the newest official position of the BDPA, think carefully about your own approach to cookies.
– “Don’t use cookie walls”, says the BDPA, while some authorities allow it in a number of other situations. The BDPA doesn’t seem to introduce the very important caveat that a cookie wall could perfectly be justified if there is indeed choice between two versions of a service.
– If you have an “accept all” button for cookies, the BDPA now requires a “Refuse all non-essential cookies” button at the same level
– The BDPA says “don’t use deceptive patterns” / dark patterns, such as “through the use of colour”. Some readers may know that I have my own views on that, in particular as far as the use of colours in line with a company’s branding is concerned.
– The BDPA asks the second layer of information of a cookie policy to include a list of all cookies, organised by category, and “including their purpose, duration and the recipients of those cookies
– The cookie preferences of unregistered guests should only be kept for a “limited” period, with the BDPA saying that 6 months is “in principle reasonable”
Questions about this, concerns? Be sure to get in touch!
data protection privacy gdpr
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗