Recent Data Protection Board Decision on Cookie and Privacy Notice Practice on Websites
- 1 day ago
- 3 min read
In its Decision dated 8 August 2024 and numbered 2024/1361, recently published by the Turkish Personal Data Protection Authority, the use of cookies on websites, contact forms, privacy notices and explicit consent processes were assessed together.
1. Cookies Requiring Explicit Consent Must Not Be Activated Before the User’s Consent Is Obtained
Where no legal basis other than explicit consent is available for functional, performance/analytics and advertising/marketing cookies, such cookies must not be activated before the user provides explicit consent.
Accordingly, cookies requiring explicit consent must be disabled by default and activated only after the user gives consent through an affirmative action. In other words, websites must employ an “opt-in” mechanism.
2. The Necessity of Analytics Cookies Must Be Assessed According to Their Purpose of Use
Whether an analytics cookie may be considered “strictly necessary” must be determined based on whether it is genuinely necessary to provide a service explicitly requested by the user.
The mere use of an analytics cookie to measure advertising effectiveness is not sufficient for the cookie to be considered “strictly necessary.”
3. The Cookie Privacy Notice Must Be Consistent with the Current Cookie Inventory
It is not sufficient for a cookie privacy notice to include only general descriptions of cookie categories such as “strictly necessary,” “functional,” “performance/analytics” or “advertising/marketing.”
The names of the cookies actually used on the website, together with their purposes and retention periods, must be stated clearly and in detail. The cookie privacy notice must be kept consistent with the current cookies used on the website.
4. Requests for Information Must Not Be Conditional upon Consent to Advertising and Marketing
Users wishing to obtain information about products or services through a contact form must not be required to consent simultaneously to the processing of their personal data for advertising, promotional or campaign-related purposes.
Responding to a request for information and processing personal data for advertising and marketing purposes constitute separate processing purposes. These processes must therefore be separated, and explicit consent to advertising or marketing activities must not be made a prerequisite for submitting the contact form or obtaining the requested information.
5. Different Processing Purposes Must Not Be Combined under a Single Explicit Consent
For explicit consent to be valid, it must relate to a specific matter, be based on adequate information and be freely given.
Contacting a user in response to their request and sending advertising, promotional or campaign-related communications to that user constitute different processing purposes. Combining these purposes under a single consent option may undermine the requirements that consent be specific and freely given. Users must therefore be able to make a separate choice for each processing purpose.
6. Privacy Notices and Explicit Consent Must Be Structured as Separate Processes
Fulfilling the obligation to inform data subjects and obtaining explicit consent are separate processes. A privacy notice must not be drafted to include a declaration of consent to advertising or marketing activities.
The data subject must first be informed of the identity of the data controller, the purposes and legal grounds for processing their personal data and the parties to whom such data may be transferred. A separate choice and consent mechanism must then be provided for processing activities requiring explicit consent.
Conclusion
The Board imposed a total administrative fine of TRY 265,000 on the data controller for using analytics cookies without obtaining explicit consent, making a request for information conditional upon consent to data processing for advertising and marketing purposes, and failing to duly fulfil the obligation to inform data subjects.
In light of the Decision, it is important to verify whether:
Cookies requiring explicit consent are activated before the user’s consent is obtained;
The cookie privacy notice contains sufficient information regarding the cookies actually used;
Contact forms are conditional upon consent to advertising and marketing;
Separate choices are offered for different processing purposes; and
Privacy notice and explicit consent processes are properly separated.
Author
Buse Özer
