Out-Law Analysis 3 min. read
31 May 2017, 2:52 pm
The European Commission's plans for a new e-Privacy Regulation would direct internet users to express whether they consent to the use of third-party cookies via settings in their web browsers. Third-party cookies are used by advertising networks and website operators to deliver targeted advertising and personalised services to internet users.
In theory, the Commission's envisaged mechanism of consent offers consumers an easy-to-use tool with which to control how their data is used online.
However, in reality, browser settings have not yet developed to the point where they would allow internet users to select, on a granular level, which third parties they allow to use their data. Instead, through current tools on the market, consumers would be forced into making a global choice about whether to allow all third-party cookies or none.
The solution provided for in the Commission's proposals is unsatisfactory. Many consumers faced with a 'yes/no' choice could simply decide to prevent third-parties monitoring their online activity through cookies. For those that opt-in, it would be likely that their data would be used by some businesses or advertisers that they would have no interest in taking up offers or services with.
The consent mechanism envisaged, therefore, is too black and white. Publishers are right to raise concern about it.
Earlier this week, senior executives from 40 publishers, including the Financial Times, Guardian Media Group, Le Monde and Der Spiegel, criticised the Commission's plans in an open letter (3-page / 116KB PDF) addressed to MEPs and officials at the EU's Council of Ministers.
In their letter, the publishers warned of the effect the e-Privacy proposals could have on their advertising revenues and the subsequent impact a drop in revenues could have for the quality of their journalism.
"By creating a single global permission within the browser interface, the Commission´s e-Privacy proposals will make it more difficult to ensure transparency and meaningful user empowerment in practice, and remove any distinction between publishers who place a high value on the trust of their users, and those who do not," the publishers said.
"While the explanatory memorandum accompanying the e-Privacy proposals does not place an outright ban on publishers communicating with readers in order to seek consent for the use of 3rd party cookies, in practice, publishers are concerned that it will be incredibly difficult to persuade readers to change their browser settings to allow third party cookies. As a consequence, individual news organisations would be unable to provide readers with personalised content and marketing, or serve relevant digital advertising within their environments," they said.
The e-Privacy proposals contrast with the EU's General Data Protection Regulation (GDPR), the publishers said. The GDPR "aims to empower user privacy by forcing [web]sites themselves to make sure that users understand and are empowered to control the gathering of data about their browsing behaviour in context of each site that they visit," they said.
The publishers called on MEPs and the Council of Ministers to provide for greater "flexibility" in the new e-Privacy Regulation when they come to scrutinise and amend the Commission's proposals so as "to encourage a direct relationship between each internet user and the trusted news organisations that they visit".
"The Commission’s proposals threaten to prevent news organisations from delivering basic functionality such as the marketing of products and services, the tailoring of news products to the needs and desires of news consumers, and relevant and acceptable advertising," the publishers said. "The impact on news organisations would be to reduce their ability to deliver high quality products and services, and undermine their ability to generate advertising revenues to reinvest in journalism."
The Commission's proposals are well-intentioned, but flawed. The approach to enabling consumers to exercise their consent choices would not, in a legal sense, prohibit targeted advertising and personalised services from third parties. However, it is likely that in practice that consumers would simply opt-out from such tracking at a global level.
The approach presumes that consumers are not mature or savvy enough to make consent choices on a case-by-case basis. It also runs contrary to a view previously expressed by the French data protection authority, CNIL, which said that the legal standards for obtaining consent could not be gleaned from browser settings.
Until browser technology becomes more advanced to offer a much more granular choice over which third-party cookies to allow and which to prevent, EU law makers should rethink the Commission's plans and introduce changes that reflect the more open approach consumers are taking towards their privacy choices in the digital age.
Annabelle Richard is a data protection and technology law expert at Pinsent Masons, the law firm behind Out-Law.com.