Cookie consent

What it means

Cookie consent is permission to store or read data on a visitor’s device. The Slovak electronic communications act requires it in advance for everything that is not strictly necessary to run the site, which covers analytics and advertising alike.

The quality of that consent is set by GDPR: freely given, specific, informed and as easy to withdraw as it was to give. A pre-ticked box, or a line saying that by browsing on you agree, is not consent.

The rule is not limited to cookie files. Browser local storage, tracking pixels and device fingerprinting are judged the same way, as is any technique that stores or reads data on the visitor’s device. Strictly necessary storage, such as a shopping basket or a login, needs no consent, but visitors still have to be told about it.

How it works in practice

In practice that means a banner where refusing is as easy as accepting, scripts for web analytics and ads blocked until a click, and a permanent link to change the choice. Consent is logged with its time and wording, or it cannot be proven.

Consent by itself does not cover everything: the processing that follows needs its own legal basis and belongs in the record of processing activities, while the cookie list belongs in the privacy policy. Large-scale monitoring calls for a data protection officer.

The consent management tool and the analytics are usually third-party services that process data on the site operator’s behalf. Each needs a signed data processing agreement, and for providers outside the EU it has to be checked on what basis the data is transferred, because the visitor’s consent on its own does not settle that transfer.

What to watch out for

The usual mistake is a cosmetic banner: the tags in the tag manager fire on page load and the banner merely covers them. One page load in the browser console proves it, there is no consent record to show, and on top of the fine the whole measurement setup has to be rebuilt.

When a new tool is added later, a retargeting pixel for example, consent given earlier does not cover it, because the visitor never knew about it. The banner has to be updated and consent asked for again; otherwise the new tool runs without a legal basis and the data it collected has to be deleted once that is discovered.