Cookie banner change you

12/03/2021

Just in time for the holiday season, a new law will come into effect on December 1, 2021, which (once again) will turn everything that was previously considered standard practice with regard to cookie banners on its head. What exactly are the changes? What is my banner still allowed to do and what is no longer permitted?

Cookie banners – this topic just won't go away this year. Who hasn't been annoyed by a cookie banner at some point? With increasingly creative designs, they have become part of our digital lives. "Hey, welcome to our website! You don't know us yet, but can we collect your data?“ And true to the motto ”He sees you when you're sleeping,“ Google's little helpers try to persuade us to give our consent through various tricks and creative implementations. Everyone is familiar with the eye-catching and colorful ‘Agree’ buttons (”Hey, look! It's colorful and flashing! Click on it!“) and the comparatively inconspicuous little ‘Reject’ buttons (”Have fun searching!“). Or have you ever had to fight your way through pages and pages of cookie lists to reject every single mini cookie, only to click ”Accept all" at the end in a moment of carelessness?

Website operators often argue that they need the data to optimize their website and marketing measures. They claim that there is no other way to track user behavior. Ultimately, they say, they are only doing it for the users. If you are thinking along the same lines, we highly recommend our article on cookie-less tracking (yes, it exists). Because it's not just possible without cookies, it should be done without them!

New legal situation = new obligations for cookie banners

Since December 1, 2021, the previously vague legal situation regarding cookie banners has finally been clarified. With the new German Telecommunications-Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz – TTDSG) and its Section 25, there’s a new sheriff in town, laying down clear requirements for cookie banners and defining specific legal standards. Anyone who wants to store or access information on a user's device now needs the consent of the user. This applies in principle to all information that is not absolutely necessary for the operation of the website’s own service. An online shop can still track which products a user has placed in their shopping cart. However, it may not, without consent, track where the user came from beforehand or store for others the fact that the user visited the site. If a service from the U.S. is being used as well (looking at you, Google Analytics), then consent must also be obtained—even if there may be a legitimate interest.

So. Now everyone knows when consent needs to be obtained. But if I still really want to use cookies or continue using Google Analytics, what’s the best way to do that? Here too, the rules are clear. First: implied consent is no longer valid. Anyone who has so far argued that use of their site counts as consent should urgently revise their cookie banner. So-called “nudging,” that is, pushing users toward giving consent, is also illegal from now on. That means fair conditions for accept and reject buttons! Banners that make rejecting more difficult through design, or highlight the accept option, are now invalid. Both buttons must be designed equally — visually and in wording. The dreaded cookie lists with pre-checked opt-in boxes must also be avoided.

Who should still use cookie banners now?

Only those who have to. That sounds very polemical at first, but it's true. Anyone who wants to implement a legally compliant cookie banner (and yes, you definitely should!) will quickly notice a decline in consent rates. Surprisingly, there are very few data Samaritans on the internet who voluntarily share their data with website operators without nudging or coercion. And what concrete benefits does this data actually provide? A web analysis based on a fraction of the data from a few users is not suitable for developing optimization suggestions for the website. What lessons can I learn from the behavior of perhaps one-eighth of my users? Are these insights worthwhile, especially if my banner always scares away a few users?

Our clear recommendation is therefore: Avoid cookie banners if possible! But even if you do use them, there are good alternatives and ways to track data in a legally compliant manner and create added value from it.

Feel free to contact us if you need help with your cookie banner! We will find the ideal solution for you!