<div class="country-table entry_body_content" id="per-country-table" data-title="Rules for collecting cookie consent: Per-country Comparison">
<form class="countries mb-4 pb-2" action="#">
<span>
<input type="checkbox" class="uk" id="uk" checked="">
<label for="uk">UK</label>
</span>
<span>
<input type="checkbox" class="italy" id="italy" checked="">
<label for="italy">Italy</label>
</span>
<span>
<input type="checkbox" class="germany" id="germany" checked="">
<label for="germany">Germany</label>
</span>
<span>
<input type="checkbox" class="france" id="france" checked="">
<label for="france">France</label>
</span>
<span>
<input type="checkbox" class="spain" id="spain" checked="">
<label for="spain">Spain</label>
</span>
<span>
<input type="checkbox" class="denmark" id="denmark" checked="">
<label for="denmark">Denmark</label>
</span>
<span>
<input type="checkbox" class="greece" id="greece" checked="">
<label for="greece">Greece</label>
</span>
<span>
<input type="checkbox" class="belgium" id="belgium" checked="">
<label for="belgium">Belgium</label>
</span>
<span>
<input type="checkbox" class="ireland" id="ireland" checked="">
<label for="ireland">Ireland</label>
</span>
<span>
<input type="checkbox" class="edpb" id="edpb" checked="">
<label for="edpb">EDPB</label>
</span>
</form>
<div class="text-center sticky-top">
<button class="btn d-block d-lg-inline-block text-lg button-expand"></button>
</div>
<div class="table-wrapper table-help-column-fixed">
<div class="table-first-col-fixed">
<table class="table table-bordered">
<thead>
<tr>
<th class="fixed-col">
<div>Questions</div>
</th>
<th class="uk">
<div><span class="flag">🇬🇧</span> <span>UK</span></div>
</th>
<th class="italy">
<div><span class="flag">🇮🇹</span> <span>Italy</span></div>
</th>
<th class="germany">
<div><span class="flag">🇩🇪</span> <span>Germany</span></div>
</th>
<th class="france">
<div><span class="flag">🇫🇷</span> <span data-elevio-inline="624" style="font-style: normal;">France</span></div>
</th>
<th class="spain">
<div><span class="flag">🇪🇸</span> <span>Spain</span></div>
</th>
<th class="denmark">
<div><span class="flag">🇩🇰</span> <span>Denmark</span></div>
</th>
<th class="greece">
<div><span class="flag">🇬🇷</span> <span>Greece</span></div>
</th>
<th class="belgium">
<div><span class="flag">🇧🇪</span> <span>Belgium</span></div>
</th>
<th class="ireland">
<div><span class="flag">🇮🇪</span> <span>Ireland</span></div>
</th>
<th class="edpb">
<div><span class="flag">🇪🇺</span> <span data-elevio-inline="623" style="font-style: normal;">EDPB</span></div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td class="fixed-col">Is consent by scrolling valid?</td>
<td class="uk">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="italy">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>It's valid only if the scrolldown action is part of a more complex procedure that allows to conclude that a user has deliberately and unambiguously intended to consent to cookies.</p>
<p>"Simple" scrolldown is not sufficient.</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>It's valid only if the scrolldown action is part of a more complex procedure that allows to conclude that a user has deliberately and unambiguously intended to consent to cookies.</p>
<p>"Simple" scrolldown is not sufficient.</p>
</noscript>
</td>
<td class="germany">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="france">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="spain">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="denmark">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="greece">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="belgium">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="ireland">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The cookie notice must not disappear if the user hasn't made a choice via an affirmative action.</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>The cookie notice must not disappear if the user hasn't made a choice via an affirmative action.</p>
</noscript>
</td>
<td class="edpb">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Is consent by continuing navigation valid?</td>
<td class="uk">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="italy">
<p><span>Likely no, but not specified</span></p>
</td>
<td class="germany">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="france">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="spain">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="denmark">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="greece">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="belgium">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="ireland">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="edpb">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Are explicit "accept" AND "reject" buttons required to be on the cookie notice?</td>
<td class="uk">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The ICO clearly favors an approach that clearly gives users the choice between <strong>accepting</strong> and <strong>rejecting</strong> all cookies, alongside handles to customize their choices.</p>
<p>However, it must be noted that the ICO does not explicitly require "reject all" buttons. Therefore, as long as the available choices are all equally conspicuous, an alternative between "accept all" and "customize" seems to be fine, as long as by choosing the latter no consent is implied.</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>The ICO clearly favors an approach that clearly gives users the choice between <strong>accepting</strong> and <strong>rejecting</strong> all cookies, alongside handles to customize their choices.</p>
<p>However, it must be noted that the ICO does not explicitly require "reject all" buttons. Therefore, as long as the available choices are all equally conspicuous, an alternative between "accept all" and "customize" seems to be fine, as long as by choosing the latter no consent is implied.</p>
</noscript>
</td>
<td class="italy">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>According to the Italian DPA the banner must contain:</p>
<ul><li>an "Accept" command;</li>
<li>an "X" or any equally unambiguous command that users may click on to close the banner and continue navigating without accepting any cookies ("Reject").</li></ul>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>According to the Italian DPA the banner must contain:</p>
<ul><li>an "Accept" command;</li>
<li>an "X" or any equally unambiguous command that users may click on to close the banner and continue navigating without accepting any cookies ("Reject").</li></ul>
</noscript>
</td>
<td class="germany">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Accept and reject buttons must be equally conspicuous. Alternatively, there must be an equally easy method to <strong>refuse</strong> all cookies (e.g. by continued navigation) and the user is clearly informed of it.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Accept and reject buttons must be equally conspicuous. Alternatively, there must be an equally easy method to <strong>refuse</strong> all cookies (e.g. by continued navigation) and the user is clearly informed of it.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The Spanish Authority lists two examples as valid (<a href="https://www.aepd.es/media/guias/guia-cookies.pdf">page 20 of the guide</a>):</p>
<ul>
<li>where the cookie notice contains both “Accept” AND “Reject” buttons, or</li>
<li>where the cookie notice contains an “Accept” button and a link within the text of the notice which goes to the extensive cookie policy – allowing users to set preferences on a per-purpose basis.</li>
</ul>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>The Spanish Authority lists two examples as valid (<a href="https://www.aepd.es/media/guias/guia-cookies.pdf">page 20 of the guide</a>):</p>
<ul>
<li>where the cookie notice contains both "Accept" AND "Reject" buttons, or</li>
<li>where the cookie notice contains an "Accept" button and a link within the text of the notice which goes to the extensive cookie policy – allowing users to set preferences on a per-purpose basis.</li>
</ul>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>They must be equally conspicuous.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>They must be equally conspicuous.</p>
</noscript>
</td>
<td class="greece">
<p><span>Not specified</span></p>
</td>
<td class="belgium">
<p><span>YES</span></p>
</td>
<td class="ireland">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>If an "accept all" button is provided, an equally prominent "reject all" button must be also available.</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>If an "accept all" button is provided, an equally prominent "reject all" button must be also available.</p>
</noscript>
</td>
<td class="edpb"></td>
</tr>
<tr>
<td class="fixed-col">Must accept and reject options be equally conspicuous (equal prominence requirement)</td>
<td class="uk">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="italy">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="germany">
<p>
<span>Not specified</span>
</p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="spain">
<p>
<span>Best practice</span>
</p>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="greece">
<p>
<span>Not specified</span>
</p>
</td>
<td class="belgium">
<p>
<span>Not specified</span>
</p>
</td>
<td class="ireland">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="edpb">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
</tr>
<tr>
<td class="fixed-col">Is the prior blocking of cookies necessary where consent is required?</td>
<td class="uk">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="italy">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="germany">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>When consent is required, cookies must be blocked until the user has given their consent.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>When consent is required, cookies must be blocked until the user has given their consent.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>A website owner that runs several SIMILAR websites may inform users about cookies and <a href="https://www.aepd.es/media/guias/guia-cookies.pdf">collect consent for all of them in one go (p.29)</a> for the use of cookies on several websites that belong to you or even third parties connected to you. However this must only apply to Spanish users.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>A website owner that runs several SIMILAR websites may inform users about cookies and <a href="https://www.aepd.es/media/guias/guia-cookies.pdf">collect consent for all of them in one go (p.29)</a> for the use of cookies on several websites that belong to you or even third parties connected to you. However this must only apply to Spanish users.</p>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>No cookie except for those strictly necessary for the websites' functioning (e.g. shopping cart cookie) may be set before the user has consented.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>No cookie except for those strictly necessary for the websites' functioning (e.g. shopping cart cookie) may be set before the user has consented.</p>
</noscript>
</td>
<td class="greece">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="belgium">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="ireland">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="edpb">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Are full cookie walls admitted?</td>
<td class="uk">
<p>
<span>Unlikely</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>No definitive statement has been made however the ICO guidelines state that <a href="/en/help/24487">cookie walls</a> are "unlikely to be valid".</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>No definitive statement has been made however the ICO guidelines state that <a href="/en/help/24487">cookie walls</a> are "unlikely to be valid".</p>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Unless the website owner provides an alternative possibility to access the service without accepting consent-requiring cookies (possibly against payment, not specified).</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>Unless the website owner provides an alternative possibility to access the service without accepting consent-requiring cookies (possibly against payment, not specified).</p>
</noscript>
</td>
<td class="germany">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="france">
<p>
<span>Possibly</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>In principle, yes, but this remains to be determined on a case–by–case bases – however, users must be clearly informed about the consequences of not accepting cookies.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>In principle, yes, but this remains to be determined on a case-by-case bases – however, users must be clearly informed about the consequences of not accepting cookies.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookie walls are only acceptable if the user has an alternative for accessing the service without accepting cookies.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookie walls are only acceptable if the user has an alternative for accessing the service without accepting cookies.</p>
</noscript>
</td>
<td class="denmark">
<p><span>Possibly</span></p>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookie walls are allowed, as long as certain criteria are met:</p><ul><li>users must be given a reasonable alternative to the processing of their personal data (e.g., a reasonable monetary fee);</li><li>any data processed after a user provides consent (as an alternative to payment) must be a necessary part of the non-monetary alternative, or else separate consent must be obtained;</li><li>if the user chooses to make monetary payment, no personal data should be processed other than as necessary to provide the service requested, unless separate consent is provided.</li></ul>"data-popover-title="Denmark"><i class="i-help"></i></span>
<noscript>
<p>Cookie walls are allowed, as long as certain criteria are met:</p><ul><li>users must be given a reasonable alternative to the processing of their personal data (e.g., a reasonable monetary fee);</li><li>any data processed after a user provides consent (as an alternative to payment) must be a necessary part of the non-monetary alternative, or else separate consent must be obtained;</li><li>if the user chooses to make monetary payment, no personal data should be processed other than as necessary to provide the service requested, unless separate consent is provided.</li></ul>
</noscript>
</td>
<td class="greece">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="belgium">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="ireland">
<p>
<span>Likely no</span> </p>
</td>
<td class="edpb">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Must cookies be listed one by one?<br></td>
<td class="uk">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The ICO states that simply listing numerous cookies could be confusing to the user and best practice would be to give a description of the cookies. According to the <a href="https://www.legislation.gov.uk/uksi/2003/2426">PECR</a>, the clarity and comprehensiveness of cookies is key (see Section 6 (2)).</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>The ICO states that simply listing numerous cookies could be confusing to the user and best practice would be to give a description of the cookies. According to the <a href="https://www.legislation.gov.uk/uksi/2003/2426">PECR</a>, the clarity and comprehensiveness of cookies is key (see Section 6 (2))</p>
</noscript>
</td>
<td class="italy">
<p>
<span>Not specified</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Seems unlikely.</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>Seems unlikely.</p>
</noscript>
</td>
<td class="germany">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="france">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="spain">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>A per-purpose listing is valid and sufficient.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>A per-purpose listing is valid and sufficient.</p>
</noscript>
</td>
<td class="denmark">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="greece">
<p>
<span>Not clear</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>There have been contradictory statements issued. A recent <a href="https://help.iubenda.com/wp-content/uploads/2020/07/GOOGLE-TRANSLATE-OF-GREEK-PRESS-RELEASE_February-2020.pdf">press release</a> states that the purpose of "each single tracker" must be specified (point 3), while the very next point (4) states that information about <strong>lifetime, controller and recipients </strong>of each tracker or <strong>category of trackers </strong>of the same purpose must be disclosed.</p>" data-popover-title="Greece"><i class="i-help"></i></span>
</p>
<noscript>
<p>There have been contradictory statements issued. A recent <a href="https://help.iubenda.com/wp-content/uploads/2020/07/GOOGLE-TRANSLATE-OF-GREEK-PRESS-RELEASE_February-2020.pdf">press release</a> states that the purpose of "each single tracker" must be specified (point 3), while the very next point (4) states that information about <strong>lifetime, controller and recipients </strong>of each tracker or <strong>category of trackers </strong>of the same purpose must be disclosed.</p>
</noscript>
</td>
<td class="belgium">
<p>
<span>Not clear</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>There have been contradictory statements issued. The DPA states expressly that "the GDPR does not require per-cookie consent", however, it also states that, while on a first level consent must only be collected on a per-purpose basis, on the second level users must be given the option to allow cookies granularly (on a per-cookie basis).</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>There have been contradictory statements issued. The DPA states expressly that "the GDPR does not require per-cookie consent", however, it also states that, while on a first level consent must only be collected on a per-purpose basis, on the second level users must be given the option to allow cookies granularly (on a per-cookie basis).</p>
</noscript>
</td>
<td class="ireland">
<p>
<span>Likely no</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The guidance states "Controllers must ensure that consent is obtained for each purpose for which cookies are set. This does not mean that consent needs to be obtained individually for each cookie, but merely for the purpose for which it is being used."</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>The guidance states "Controllers must ensure that consent is obtained for each purpose for which cookies are set. This does not mean that consent needs to be obtained individually for each cookie, but merely for the purpose for which it is being used."</p>
</noscript>
</td>
<td class="edpb"></td>
</tr>
<tr>
<td class="fixed-col">Must purposes be listed in the first layer of the cookie notice?</td>
<td class="uk">
<p>
<span>Not mentioned, but unlikely.</span>
</p>
</td>
<td class="italy">
<p>
<span>Best practice</span>
</p>
</td>
<td class="germany">
<p>
<span>Not specified</span>
</p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
<td class="greece">
<p><span>Not specified</span></p>
</td>
<td class="belgium">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>In a recent decision, the DPA explicitly states that:</p>
<p>the following information must be made available to users before giving consent (which may imply that it must be provided in the first layer):</p>
<ul>
<li>identity of controller(s)</em></li>
<li><strong> purposes</strong></li>
<li>how to accept/trackers</li>
<li>consequences of accepting or rejecting trackers</li>
<li>the existence of a right to withdraw consent.</li>
</ul>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>In a recent decision, the DPA explicitly states that:</p>
<p>the following information must be made available to users before giving consent (which may imply that it must be provided in the first layer):</p>
<ul>
<li>identity of controller(s)</em></li>
<li><strong> purposes</strong></li>
<li>how to accept/reject trackers</li>
<li>consequences of accepting or rejecting trackers</li>
<li>the existence of a right to withdraw consent.</li>
</ul>
</noscript>
</td>
<td class="ireland">
<p><span>Not specified</span></p>
</td>
<td class="edpb">
<p><span>Not specified</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Must consent be granular on a per-purpose basis?</td>
<td class="uk">
<p>
<span>Per-service but not necessarily per-purpose</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>It must cover all of the purposes of processing. This can be done through global or specific consent.
</p>
<p><a href=" https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules4">ICO states that:</a></br>
<em>"Long tables or detailed lists of all the cookies operating on the site may be the type of information that your users will want to consider. Some sites might use tens or even hundreds of cookies and therefore it may also be helpful to provide a broader explanation of the way cookies operate and the categories of cookies in use. For example, a description of the types of things you use analytics cookies for on the site will be more likely to satisfy the requirements than simply listing all the cookies you use with basic references to their function.”</em> </p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>It must cover all of the purposes of processing. This can be done through global or specific consent.
</p>
<p><a href=" https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules4">ICO states that:</a></br>
<em>"Long tables or detailed lists of all the cookies operating on the site may be the type of information that your users will want to consider. Some sites might use tens or even hundreds of cookies and therefore it may also be helpful to provide a broader explanation of the way cookies operate and the categories of cookies in use. For example, a description of the types of things you use analytics cookies for on the site will be more likely to satisfy the requirements than simply listing all the cookies you use with basic references to their function.”</em> </p>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>It must be granular, but the criteria of granularity are left to the provider of the service for implementation. In terms of grouping criteria the Garante refers to "functionality", "third-parties" and "cookie category".</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>It must be granular, but the criteria of granularity are left to the provider of the service for implementation. In terms of grouping criteria the Garante refers to "functionality", "third-parties" and "cookie category".</p>
</noscript>
</td>
<td class="germany">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>There are two aspects to this requirement:</p>
<ul>
<li>You must clearly separate cookies requiring consent from those that do not (Don’t collect consent for cookies that do not need it).</li>
<li>Consent must be granular. However, it’s not clear how granular. The DPAs have simply mentioned that "it must be possible to select single processing activities singularly".</li>
</ul>
<p>However, so far there has been no practical implementation of a cookie-by-cookie selection, or any literature or case-law on the matter. As an extreme level of granularity may actually confuse and reduce transparency for users, it seems likely that per-purpose grouping would be sufficient in this case.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>There are two aspects to this requirement:</p>
<ul>
<li>You must clearly separate cookies requiring consent from those that do not (Don’t collect consent for cookies that do not need it).</li>
<li>Consent must be granular. However, it’s not clear how granular. The DPAs have simply mentioned that "it must be possible to select single processing activities singularly".</li>
</ul>
<p>However, so far there has been no practical implementation of a cookie-by-cookie selection, or any literature or case-law on the matter. As an extreme level of granularity may actually confuse and reduce transparency for users, it seems likely that per-purpose grouping would be sufficient in this case.</p>
</noscript>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Consent to cross-website/app trackers should be renewed on every single affected website/app.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Consent to cross-website/app trackers should be renewed on every single affected website/app.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Not explicitly stated but clearly implied.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Not explicitly stated but clearly implied.</p>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Users must have the option of accepting cookies purpose-by-purpose (actually, the guide says "categories of purposes"). A cookie-by-cookie approach is explicitly declared as not required.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>Users must have the option of accepting cookies purpose-by-purpose (actually, the guide says "categories of purposes"). A cookie-by-cookie approach is explicitly declared as not required.</p>
</noscript>
</td>
<td class="greece">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="belgium">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>On the first level a per-purpose approach is sufficient and reasonable. On the second level, a cookie-per-cookie approach is mentioned ad viable. But it's neither expressly recommended, nor purported as mandatory.</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>On the first level a per-purpose approach is sufficient and reasonable. On the second level, a cookie-per-cookie approach is mentioned ad viable. But it's neither expressly recommended, nor purported as mandatory.</p>
</noscript>
</td>
<td class="ireland">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="edpb">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Is <a href="/en/help/5428#records-of-consent">GDPR-aligned</a> proof of consent required?</td>
<td class="uk">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="italy">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="germany">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>As per <a href="https://www.cnil.fr/sites/default/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf">no. 29 of CNIL's. 2020 guidelines</a>, proof of consent is required is accordance with the GDPR requirements. The consent collecting entity must also be able to handover proof of consent to other the third-parties that have relied on that consent in order to process the user's data.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>As per <a href="https://www.cnil.fr/sites/default/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf">no. 29 of CNIL's. 2020 guidelines</a>, proof of consent is required is accordance with the GDPR requirements. The consent collecting entity must also be able to handover proof of consent to other the third-parties that have relied on that consent in order to process the user's data.</p>
</noscript>
</td>
<td class="spain">
<p><span>Not specified (but implied)</span></p>
</td>
<td class="denmark">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="greece">
<p><span>Not specified</span></p>
</td>
<td class="belgium">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="ireland">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="edpb">
<p>
<span>Likely yes</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Not explicitly stated.</p>" data-popover-title="EDPB"><i class="i-help"></i></span>
</p>
<noscript>
<p>Not explicitly stated.</p>
</noscript>
</td>
</tr>
<tr>
<td class="fixed-col">Should withdrawing consent be as simple as giving it? </td>
<td class="uk">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>According to the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-manage-consent/">ICO</a> "It must also be as easy to withdraw consent as it was to give it. This means the process of withdrawing consent should be an easily accessible one-step process. If possible, individuals should be able to withdraw their consent using the same method as when they gave it."</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>According to the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-manage-consent/">ICO</a> "It must also be as easy to withdraw consent as it was to give it. This means the process of withdrawing consent should be an easily accessible one-step process. If possible, individuals should be able to withdraw their consent using the same method as when they gave it."</p>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Ideally through a link in the website's footer.</p>
<p>The Garante also suggests to provide an icon always visible during navigation that summarises the user's choices.</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>Ideally through a link in the website's footer.</p>
<p>The Garante also suggests to provide an icon always visible during navigation that summarises the user's choices.</p>
</noscript>
</td>
<td class="germany">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Users must be clearly informed about how they can withdraw consent before granting it. A link/icon or any other static element allowing users to withdraw consent at a later stage should always be clearly visible and accessible on the website/app.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Users must be clearly informed about how they can withdraw consent before granting it. A link/icon or any other static element allowing users to withdraw consent at a later stage should always be clearly visible and accessible on the website/app.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The technical implementation of this largely depends on how the consent is collected. For example, if consent is collected by scrolling down, there must be a "reject all" button on the banner to allow for an equally easy way to reject.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>The technical implementation of this largely depends on how the consent is collected. For example, if consent is collected by scrolling down, there must be a "reject all" button on the banner to allow for an equally easy way to reject.</p>
</noscript>
</td>
<td class="denmark">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="greece">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="belgium">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="ireland">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="edpb">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
</tr>
<tr>
<td class="fixed-col">Is the use of a consent banner recommended?</td>
<td class="uk">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="italy">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="germany">
<p>
<span>Best practice</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Most common practice for collecting consent for cookies that require it. Cookies that do not require consent (see first row above) must not be listed on the banner.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>Most common practice for collecting consent for cookies that require it. Cookies that do not require consent (see first row above) must not be listed on the banner.</p>
</noscript>
</td>
<td class="france">
<p>
<span>Not specifically</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>A banner is not explicitly mentioned as "required". However, a static, clearly visible icon or link to the to full cookie information is "recommended".</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>A banner is not explicitly mentioned as "required". However, a static, clearly visible icon or link to the to full cookie information is "recommended".</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>It's mentioned as one of the ways to collect consent.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>It's mentioned as one of the ways to collect consent.</p>
</noscript>
</td>
<td class="denmark">
<p>
<span>Not specifically</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>It's mentioned as a standard solution, but not explicitly recommended.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>It's mentioned as a standard solution, but not explicitly recommended.</p>
</noscript>
</td>
<td class="greece">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="belgium">
<p>
<span>Not specified</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The guidance simply states that your cookie notice "may not disappear as long as the user hasn't made an active choice."</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>The guidance simply states that your cookie notice "may not disappear as long as the user hasn't made an active choice."</p>
</noscript>
</td>
<td class="ireland">
<p>
<span>Not specifically</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="But mentioned as the most common solution." data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>But mentioned as the most common solution.</p>
</noscript>
</td>
<td class="edpb"></td>
</tr>
<tr>
<td class="fixed-col">Are strictly necessary cookies exempt from the consent requirement?</td>
<td class="uk">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>shopping cart cookies</li>
<li>session cookies that are essential to comply with data protection security requirements (eg online banking services); </li>
<li>load-balancing cookies</li></ul>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>shopping cart cookies</li>
<li>session cookies that are essential to comply with data protection security requirements (eg online banking services); </li>
<li>load-balancing cookies</li></ul>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
</noscript>
</td>
<td class="germany">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
</noscript>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>According to CNIL's updated guidelines (Sept. 2020) some examples of strictly necessary cookies are:</p>
<ul>
<li>trackers to remember user choices re trackers (e.g. consent cookie),</li>
<li>trackers used to identify users when logging in (e.g to avoid bots logging in),</li>
<li>shopping cart trackers or user-preference trackers (language, currency etc.)</li>
<li>load balancing trackers</li>
<li><strong>trackers allowing for a differentiated treatment of paying and non-paying users ("payment walls")</strong></li>
</ul>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>- to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>- to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>According to CNIL's updated guidelines (Sept. 2020) some examples of strictly necessary cookies are:</p>
<ul>
<li>trackers to remember user choices re trackers (e.g. consent cookie),</li>
<li>trackers used to identify users when logging in (e.g to avoid bots logging in),</li>
<li>shopping cart trackers or user-preference trackers (language, currency etc.)</li>
<li>load balancing trackers</li>
<li><strong>trackers allowing for a differentiated treatment of paying and non-paying users ("payment walls")</strong></li>
</ul>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>technical cookies;</li>
<li>preference and customisation cookies.</li></ul>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>technical cookies;</li>
<li>preference and customisation cookies.</li></ul>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
</noscript>
</td>
<td class="greece">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>According to the latest press release from the Greek Data Authority, consent is generally required, including analytics cookies. Cookies exempt from this rule are those necessary:</p>
<ul>
<li>to identify and / or maintain content that the subscriber or user uploads during a session on a website throughout the specified connection, such as a "shopping cart",</li>
<li>to connect the subscriber or user to services that require authentication,</li>
<li>for the safety of the user,</li>
<li>to perform the load balancing technique on a web site link, or</li>
<li>to maintain the user's choice of website presentation, e.g. language selection, save search history.</li>
</ul>" data-popover-title="Greece"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul>
<li>to identify and / or maintain content that the subscriber or user uploads during a session on a website throughout the specified connection, such as a "shopping cart",</li>
<li>to connect the subscriber or user to services that require authentication,</li>
<li>for the safety of the user,</li>
<li>to perform the load balancing technique on a web site link, or</li>
<li>to maintain the user's choice of website presentation, e.g. language selection, save search history.</li>
</ul>
</noscript>
</td>
<td class="belgium">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong></p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>cookies used for a limited period of time (usually a session) to "remember" user input (e.g. shopping cart cookies)</li><li>authentication and login cookies (session cookies)</li><li>security</li><li>load balancing</li><li>preferences (e.g. language, search results display)</li></ul><p>Nevertheless, the users must be <strong>informed about such cookies.</strong></p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong><p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>cookies used for a limited period of time (usually a session) to "remember" user input (e.g. shopping cart cookies)</li><li>authentication and login cookies (session cookies)</li><li>security</li><li>load balancing</li><li>preferences (e.g. language, search results display)</li></ul>
<p>Nevertheless, the users must be <strong>informed about such cookies.</strong></p>
</noscript>
</td>
<td class="ireland">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Cookies and trackers <strong>strictly necessary:</strong><p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>Cookies whose sole purpose is for carrying out the transmission of a communication over a network</li><li>authentication and login cookies (session cookies)</li><li>load balancing</li><li>shopping cart</li><li>language or country preferences</li></ul>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>Cookies and trackers <strong>strictly necessary:</strong><p>
<ul>
<li>to carry out or facilitate the transmission of a communication over an electronic communications network</li>
<li>to deliver a service explicitly requested by the user</li>
</ul>
<p>do not require the user's consent.</p>
<p>Example of consent-exempted cookies:</p>
<ul><li>Cookies whose sole purpose is for carrying out the transmission of a communication over a network</li><li>authentication and login cookies (session cookies)</li><li>load balancing</li><li>shopping cart</li><li>language or country preferences</li></ul>
</noscript>
</td>
<td class="edpb">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
</p>
</td>
</tr>
<tr>
<td class="fixed-col">Can GDPR legal bases other than consent (e.g. legitimate interest) apply?</td>
<td class="uk">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>According to the ICO, except for cookies falling under the "strictly necessary" exemption, consent seems to be the only viable solution. </br>For more information, see: <a href="https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/">the official ICO's statement</a></p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>According to the ICO, except for cookies falling under the "strictly necessary" exemption, consent seems to be the only viable solution. </br>For more information, see: <a href="https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/">the official ICO's statement</a></p>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The Garante explicitly states that other legal bases pursuant to art. 6 GDPR are not applicable.</p>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>The Garante explicitly states that other legal bases pursuant to art. 6 GDPR are not applicable.</p>
</noscript>
</td>
<td class="germany">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>A legitimate interest is an acceptable legal basis for processing activities that are strictly necessary to operate the website/app and provide the service. Examples: shopping-cart cookies.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>A legitimate interest is an acceptable legal basis for processing activities that are strictly necessary to operate the website/app and provide the service. Examples: shopping-cart cookies.</p>
</noscript>
</td>
<td class="france">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>
</noscript>
</td>
<td class="spain">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>In any case, consent is usually the safest option.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>In any case, consent is usually the safest option.</p>
</noscript>
</td>
<td class="greece">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>
" data-popover-title="Greece"><i class="i-help"></i></span>
</p>
<noscript>
<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>
</noscript>
</td>
<td class="belgium">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Except for strictly necessary cookies, all other may only be placed based on consent.</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>Except for strictly necessary cookies, all other may only be placed based on consent.</p>
</noscript>
</td>
<td class="ireland">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>Except for strictly necessary cookies, consent is mentioned as legal basis for other cookies. No mention about other legal bases.</p>
</noscript>
</td>
<td class="edpb"></td>
</tr>
<tr>
<td class="fixed-col">Do third parties have to be listed and identified?</td>
<td class="uk">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>ICO guidelines state "if you use any third party cookies, you must clearly and specifically name who the third parties are and explain what they will do with the information".</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>ICO guidelines state "if you use any third party cookies, you must clearly and specifically name who the third parties are and explain what they will do with the information".</p>
</noscript>
</td>
<td class="italy">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="germany">
<p>
<span>Not specifically stated</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Depends on the legal basis for processing. If the basis is consent, then the third-parties should be mentioned in order for the consent to be considered "informed". In other cases, it is still the best and most common practice to identify the third-parties.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>Depends on the legal basis for processing. If the basis is consent, then the third-parties should be mentioned in order for the consent to be considered "informed". In other cases, it is still the best and most common practice to identify the third-parties.</p>
</noscript>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>You need to mention all the third parties that place cookies subject to consent. Also, you have to provide a link to their respective privacy notices and company data.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>You need to mention all the third parties that place cookies subject to consent. Also, you have to provide a link to their respective privacy notices and company data.</p>
</noscript>
</td>
<td class="spain">
<p>
<span>YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Third-parties must be identified by their commonly known brand, however, identifying the specific legal entity is not required.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Third-parties must be identified by their commonly known brand, however, identifying the specific legal entity is not required.</p>
</noscript>
</td>
<td class="denmark">
<p><span class="bg-primary text-white d-inline-block px-2 rounded">YES</span></p>
</td>
<td class="greece">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>This appears to be required whether or not the third-parties are joint <a href="/en/help/5428#definitions">data controllers or processors</a>.</p>" data-popover-title="Greece"><i class="i-help"></i></span>
</p>
<noscript>
<p>This appears to be required whether or not the third-parties are joint <a href="/en/help/5428#definitions">data controllers or processors</a>.</p>
</noscript>
</td>
<td class="belgium">
<p>
<span>Not specified</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The Authority's <a href="https://www.autoriteprotectiondonnees.be/cookies">FAQ</a> does not include naming third parties in their list of minimum requirements for cookie policies.</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>The Authority's <a href="https://www.autoriteprotectiondonnees.be/cookies">FAQ</a> does not include naming third parties in their list of minimum requirements for cookie policies.</p>
</noscript>
</td>
<td class="ireland">
<p>
<span>Not completely clear</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The guidance states that you're required to provide links to each third party’s privacy policy while simultaneously stating that you must “provide the information required under the GDPR” – which does not necessarily include listing all third-parties. However, it seems likely.</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>The guidance states that you're required to provide links to each third party’s privacy policy while simultaneously stating that you must “provide the information required under the GDPR” – which does not necessarily include listing all third-parties. However, it seems likely.</p>
</noscript>
</td>
<td class="edpb"></td>
</tr>
<tr>
<td class="fixed-col">Is it specified how long the consent to a cookie should last?</td>
<td class="uk">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>However, it must be justifiable for the stated purpose of the cookie. You must also inform users of the duration of the cookies you use.</p>" data-popover-title="UK"><i class="i-help"></i></span>
</p>
<noscript>
<p>However, it must be justifiable for the stated purpose of the cookie. You must also inform users of the duration of the cookies you use.</p>
</noscript>
</td>
<td class="italy">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Users may be prompted to provide consent again only if:</p>
<ul>
<li>consent conditions have changed (e.g. new third-party services have been added or old ones have been taken out); or</li>
<li>the website owner has no technical means to keep track of previous consent (e.g. the user has deleted the consent cookie placed on his device); or</li>
<li>at least 6 months have passed since the last consent.</li>
</ul>" data-popover-title="Italy"><i class="i-help"></i></span>
</p>
<noscript>
<p>Users may be prompted to provide consent again only if:</p>
<ul>
<li>consent conditions have changed (e.g. new third-party services have been added or old ones have been taken out); or</li>
<li>the website owner has no technical means to keep track of previous consent (e.g. the user has deleted the consent cookie placed on his device); or</li>
<li>at least 6 months have passed since the last consent.</li>
</ul>
</noscript>
</td>
<td class="germany">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="france">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Users' choices (both accept and reject) must be stored for a reasonable period of time (i.e. <strong>6 months</strong>) in order to avoid setting users under pressure by prompting them to give consent again and again.</p>
<p>The same goes for the refusal of consent: the controller can prompt users to consent again only after 6 months.</p>
<p>Analytics cookies cannot last more than 13 months. Information collected by cookies can be stored for a maximum of 25 months.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Users' choices (both accept and reject) must be stored for a reasonable period of time (i.e. <strong>6 months</strong>) in order to avoid setting users under pressure by prompting them to give consent again and again.</p>
<p>The same goes for the refusal of consent: the controller can prompt users to consent again only after 6 months.</p>
<p>Analytics cookies cannot last more than 13 months. Information collected by cookies can be stored for a maximum of 25 months.</p>
</noscript>
</td>
<td class="spain">
<p>
<span>Indirectly</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Via reference to the WP29, the recommendation is to re-ask for consent no later than 24 months after it has been collected.</p>" data-popover-title="Spain"><i class="i-help"></i></span>
</p>
<noscript>
<p>Via reference to the WP29, the recommendation is to re-ask for consent no later than 24 months after it has been collected.</p>
</noscript>
</td>
<td class="denmark">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The guidelines suggest that technically consent "doesn't expire". However, do note that these guidelines are meant for any consent-based processing – they're not specifically tailored for cookies or trackers.</p>" data-popover-title="Denmark"><i class="i-help"></i></span>
</p>
<noscript>
<p>The guidelines suggest that technically consent "doesn't expire". However, do note that these guidelines are meant for any consent-based processing – they're not specifically tailored for cookies or trackers.</p>
</noscript>
</td>
<td class="greece">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>However, it's heavily suggested that in case of "rejection" users should not be prompted again and again at each new website visit to give consent. Currently there's no specification on how long after rejection they can be asked again.</p>" data-popover-title="Greece"><i class="i-help"></i></span>
</p>
<noscript>
<p>However, it's heavily suggested that in case of "rejection" users should not be prompted again and again at each new website visit to give consent. Currently there's no specification on how long after rejection they can be asked again.</p>
</noscript>
</td>
<td class="belgium">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Currently what's stated is that cookies may not be stored for longer than necessary to achieve the stated purpose.</p>" data-popover-title="Belgium"><i class="i-help"></i></span>
</p>
<noscript>
<p>Currently what's stated is that cookies may not be stored for longer than necessary to achieve the stated purpose.</p>
</noscript>
</td>
<td class="ireland">
<p>
<span class="bg-primary text-white d-inline-block px-2 rounded">YES</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The Authority states that as best practice, consent should never be valid for more than 6 months – after 6 months users must be asked for consent again.</p>" data-popover-title="Ireland"><i class="i-help"></i></span>
</p>
<noscript>
<p>The Authority states that as best practice, consent should never be valid for more than 6 months – after 6 months users must be asked for consent again.</p>
</noscript>
</td>
<td class="edpb">
<p>
<span>No duration explicitly stated</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>The EDPB <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf">states</a> "In principle, it can be sufficient to ask for a data subject’s consent once. However, controllers do need to obtain a new and specific consent if purposes for data processing change after consent was obtained or if an additional purpose is envisaged."</p>" data-popover-title="EDPB"><i class="i-help"></i></span>
</p>
<noscript>
<p>The EDPB <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf">states</a> "In principle, it can be sufficient to ask for a data subject’s consent once. However, controllers do need to obtain a new and specific consent if purposes for data processing change after consent was obtained or if an additional purpose is envisaged."</p>
</noscript>
</td>
</tr>
<tr>
<td class="fixed-col">Are pre-ticked boxes allowed?</td>
<td class="uk">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="italy">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="germany">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Not for cookies requiring consent.</p>" data-popover-title="Germany"><i class="i-help"></i></span>
</p>
<noscript>
<p>Not for cookies requiring consent.</p>
</noscript>
</td>
<td class="france">
<p>
<span class="bg-danger text-white d-inline-block px-2 rounded">NO</span>
<span class="help-popover bg-dark-gray text-dark d-inline-block px-1 rounded ml-1" data-popover-content="<p>Also toggle buttons (if used) must always be de-activated by default.</p>" data-popover-title="France"><i class="i-help"></i></span>
</p>
<noscript>
<p>Also toggle buttons (if used) must always be de-activated by default.</p>
</noscript>
</td>
<td class="spain">
<p><span>Not specified</span></p>
</td>
<td class="denmark">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="greece">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="belgium">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="ireland">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
<td class="edpb">
<p><span class="bg-danger text-white d-inline-block px-2 rounded">NO</span></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
!
