In addition to outsourcing data processing, cookies and tracking measures are now an integral part of everyday life in digital companies. Here, too, there are notable innovations that are to be regulated in a new form in the ePrivacy Regulation, which is also planned to come into force in May 2018.
To date, the so-called opt-out principle has applied uruguay number dataset to the use of cookies in Germany. According to this principle, companies must provide information about the use of cookies in a privacy policy and give users the opportunity to object to the use of these cookies. In practice, the use of cookie banners has also become established for this purpose. Since this regulation has been declared to be in line with the directive by the EU Commission, companies have been able to rely on it up to now. However, once the ePrivacy Regulation comes into force (introduction is also planned for May 2018), companies will have to prepare for a change in this practice.
The draft of the new e-Privacy Regulation, announced in January 2017, will take precedence over the GDPR due to its more specific provisions. The new draft will bring significant changes to the digital industry. According to the regulations contained therein, cookies may only be used data securitywith the user's consent (opt-in) . Exceptions only apply if the data is collected to enable communication over a network or if the use is necessary to use an information service that the user has expressly requested. Cookies can therefore still be set for purely communication purposes (e.g. user profiles or shopping carts) without consent . Consent should also not be required if a session cookie is set, which enables a multi-page form to be filled out.
Unlike the current legal situation in Germany, however, this does not apply to tracking or other user tracking. According to the current draft of the e-Privacy Regulation, so-called third-party and other tracking cookies will in future require explicit consent from users . Consent must also be revocable at any time. According to the draft law, consent should also be possible via the browser settings. Whether browser manufacturers will provide suitable tools for this is still an open question. In addition, due to the "privacy by design" requirement, general consent should not be assumed. Users would therefore have to specifically decide whether third-party cookies should be stored in their browser. It is more than questionable whether users choose this setting consciously.
Conclusion:
In the future, unless explicit consent is given via the browser, tracking would only be possible if consent is requested via a separate notice on the website. This will pose considerable challenges for digital practice.
Even though the ePrivacy Regulation is still in the draft stage, companies must prepare for significant changes. This is also likely to have an impact on click tracking in newsletter marketing, as users are also tracked here. Companies should therefore keep an eye on the legislation and adapt their websites or marketing campaigns accordingly.