Analytics and A/B Testing Cookies — Only After Consent in Europe?

Defendant: Planet49 GmbH
Nowadays, one might hide behind the strictly necessary’ cookie exemption. I even heard someone say “but our legal team said we can place the Google Analytics cookie without consent”. I was also in that camp until I read the ICO’s new guidelines. Their site gives some good examples of what cookies are essential for website functioning and proper user interaction. With new guidelines coming out all the time, strictly adhering to one side or the other can be confusing. Some companies are now following the CNIL’s most recent recommendations.
Article 5(3) of Directive 2002/58, as amended by Directive 2009/136, must be interpreted as meaning that the information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.
It’s an optional code customers can add to their global Javascript inside the Convert Experiences A/B testing and personalization tool (see the image below on how that works).
On July 18, 2019, the French privacy authority (the CNIL) released its new guidelines regarding the use of cookies. The rules applicable to HTTP cookies also apply to many other tracking technologies (“trackers”), including local shared objects, terminal equipment fingerprints, hardware identifiers, and identifiers generated by operating systems. Just like the ICO and GDPR guidelines, here too there is no separate decision about the use of cookies, but fingerprinting now falls under consent.
____________
Article 2(f) and of Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in conjunction with Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Article 4(11) and Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation), must be interpreted as meaning that the consent referred to in those provisions is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.
For a summary of the main changes to privacy laws in Europe, watch the video below (disclaimer: in the video I mistakenly mentioned the changes were implemented in 2018, when in fact they were carried out in 2019).

What happened? What changed?

This means that analytics tools that are set up only for data collection by an organization (and not shared in any way with third parties) can be installed without consent. This change might be a hard one for Google Analytics. This special agreement from Mozilla pushed Google Analytics not to share its data with other services. At this time, it isn’t certain that this setting is available for all users. Still, if Europe is opening the door to analytics without consent, I assume Google will have to follow course and provide this feature to its European customer base.

Operative part of the judgment
But then the CNIL makes it all a little confusing by updating their Github page. The CNIL’s latest guidelines state that audience measurement and A/B testing are exempt from consent and can be placed right away (opt-out).
We actually care. Although we might be in a tough spot because of the current ICO and the ever-changing CNIL guidelines and the ePrivacy Regulations, we know that with full transparency, we will be the company of choice for brands that care about privacy and that consumers can trust.
(Reference for a preliminary ruling — Directive 95/46/EC — Directive 2002/58/EC — Regulation (EU) 2016/679 — Processing of personal data and protection of privacy in the electronic communications sector — Cookies — Concept of consent of the data subject — Declaration of consent by means of a pre-ticked checkbox)
Consent is necessary for first-party analytics cookies, even though they might not appear to be as intrusive as others that might track a user across multiple sites or devices.
You might think GDPR only caused a disruption when it came into effect in May 2018.
In the examples below, a cookie is ‘strictly necessary’ to provide a service to users. In each case, exemptions apply and no consent is required:
The French and UK data protection authorities (the CNIL and the ICO) updated their guidance notes issued in July 2019, highlighting that analytics cookies (including A/B testing and personalization) need explicit consent before being placed on a visitor’s device. They specifically refer to the GDPR when mentioning consent (like opt-ins). It must be based on active user action, not on default settings.
We as a company rebuilt our entire infrastructure to make sure we complied with GDPR and stored no personal data in cookies.
Ultimately, provide clear information to users about analytics cookies and seek their consent or share the information (old cookie banners). This is likely to involve showing users why these cookies are useful to them — but you must ensure you aren’t pushing the user to choose one option over another.
Although it hurts our business model, we always strive to share the truth.
In October 2019, the Court of Justice of the European Union (the ‘CJEU’) ruled in its “Planet49” judgment that the GDPR-standard consent also applies to the setting of cookies under the ePrivacy Directive, following the interpretation that the CNIL and the ICO had implemented since July 2019.

The Battle of the ‘Strictly Necessary’ Cookie Exemption

We have Planet49 to thank for that.
If still in doubt, here’s a diagram from the ICO that explains the use of cookies really well.
We see website optimization as a noble craft, in the best interest of website visitors and owners (our paying customers) alike. We want our customers to take privacy seriously and build warnings and privacy right into every layer of our tools. We only store aggregated data — and no personal data — into our tools, for the sake of compliance and privacy.

• A cookie used to remember the products a user wishes to buy when they go to the checkout or add goods to their shopping basket,
• Cookies that are essential to comply with the GDPR’s security principle for an activity the user has requested — for example, in connection with online banking services,
• Cookies that help ensure that the content of a page loads quickly and effectively by distributing the workload across numerous computers (this is often referred to as ‘load balancing’ or ‘reverse proxying”).

(Case C-673/17) 1

Although no other European national privacy authorities came with such additions to the ePrivacy Directive laws (that were in place before GDPR), this might have created a legal vacuum between July 2020 and the moment the new ePrivacy Regulations will replace the current Directive.

• Cookies used for analytics, e.g. to count the number of unique visits to a website (that would include personalization and A/B testing),
• First and third-party advertising cookies (including those used for operational purposes related to third-party advertising, such as click fraud detection, research, product improvement, etc.),
• Cookies used to recognize a user when they return to a website so that the greeting they receive can be tailored (personalization is specifically mentioned by the ICO).

The ECJ “Planet49” Judgment of 1 October 2019

The ruling of the CJEU states that it does not matter whether personal data is collected through cookies. Consent must be obtained even when cookie placement does not involve processing personal data. The controller should inform users of the lifespan of each cookie and of any third parties’ access to information collected through such cookies, prior to getting their consent.
Analytics cookies do not fall within the ‘strictly necessary’ exemption for the ICO. This means businesses need to inform users about analytics cookies and gain consent for their use in the UK, while in France, the CNIL allows analytics (with limitations) and A/B testing without consent.
Even though we had to wait for the results (attached in full at the bottom of the article), the ruling set the tone that clearer guidelines were needed for each country.
Referring court Some interpreted the EDPB’s opinion as meaning that all references to “consent” in the ePrivacy Directive mean consent as defined by the GDPR. For cookies, this means you can’t place cookies without people actively opting in.

Any Non-consent Hope for Analytics and A/B Testing Cookies?

Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Planet49 GmbH (source Curia)
So why did the ICO and also the CNIL change their guidances a year after GDPR came into effect? Why did the information regarding “opt-out” of cookies change to consent opt-in in 13 months?
Although the ICO cannot rule out the possibility of formal action in any area, this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals. However, you should also note that where you use first-party analytics cookies provided by a third party, this is not necessarily going to be the case.
Parties to the main proceedings

Because of this ruling, the CNIL and the ICO began updating their guidelines to reflect how the current privacy laws cover consent, information sharing and (analytics and tracking) cookies. We will have to wait and see if the CNIL influences other European countries to allow audience measurement and A/B testing cookies.

Because of this ruling, the CNIL and the ICO began updating their guidelines to reflect how the current privacy laws cover consent, information sharing and (analytics and tracking) cookies. We will have to wait and see if the CNIL influences other European countries to allow audience measurement and A/B testing cookies.

A problem that could arise here is that companies placing cookies will try to interpret the law in their own way. But even though we make analytics, A/B testing and personalization software, we will give it to you straight.

The European ePrivacy Directive “cookie law” of 2011 and the UK version, The Privacy and Electronic Communications (EC Directive) Regulations of 2003 (“PECR”), have been recently reinterpreted by the ICO. This change means asking for ‘consent’ to drop any ‘non-essential’ cookies, whether or not personal data is collected.
If you’d like to discuss privacy, the CNAME solutions we are working on, or new legal developments, please reach out to me on LinkedIn.
In 2012, the ICO stated that implied consent (i.e. an opt-out rather than an opt-in) was permitted:
I hope this article helped shed some light on the changes happening right now in Europe.
1 OJ C 112, 26.3.2018.
Applicant: Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV

Give It to Me Straight

The European Data Protection Board (EDPB) issued a written opinion in March 2019 addressing the interplay between the ePrivacy Directive and the GDPR, because the GDPR does not mention cookies and there is a gap between the two laws.

1. The United Kingdom (ICO) and France (CNIL) privacy authorities changed their guidelines in July 2019 stating that analytics, A/B testing and personalization software like Convert Experiences, Optimizely, AB Tasty, VWO, Adobe Target, PageSense, OmniConvert, Google Optimize and the rest all need opt-in using consent to place first- and third-party cookies for their citizens.
2. France (CNIL) changed their Github page with guidelines exempting A/B testing and  basic analytics from cookie consent.
3. Germany and Spain are following either the United Kingdom (ICO) or France (CNIL) and you can expect updates on their guidelines shortly.
4. The Court of Justice of the European Union (the ‘CJEU’) ruled in its “Planet49” judgment of October 2019 that the GDPR-standard consent also applies to the setting of cookies under the ePrivacy Directive. The ruling reaffirms that the UK and French guidelines need to be adopted by all national privacy authorities.
5. The new law in draft called the ePrivacy Regulations that will replace the ePrivacy Directive has a cookie exception for A/B testing, personalization, and analytics.
6. It’s unlikely that the ICO or the CNIL will actively go after companies that use first-party analytics, A/B testing and personalization at this time. The ePrivacy Regulations will likely take effect in (mid) 2021 and there is a grace period till July 2020. The scope of these organizations’ work is very broad.
7. Draw your own conclusions based on what we consider a fair representation of what happened since July 2019 in Europe. Talk to your legal advisor. Don’t base your advice on a tool that sells consent management platforms (they want all consent), but neither from providers of analytics, A/B testing and personalization tools… us and them.

Judgment of the Court (Grand Chamber) of 1 October 2019 (request for a preliminary ruling from the Bundesgerichtshof — Germany)

Consent is necessary for first-party analytics cookies, even though they might not appear to be as intrusive as others that might track a user across multiple sites or devices.
The ICO does not distinguish between cookies used for analytics and those used for other purposes, but the CNIL does.
In February 2020, the CNIL changed its stance on this matter (thanks Paul Schmitt for pointing this out to me). Even though the ICO and the CNIL previously stated that cookies for A/B testing and analytics needed consent, the latest guidelines (in French) say otherwise:
When us A/B testing companies adapted GDPR practices, analytics and A/B testing cookies could be presented to customers as essential for a business. Instead, the focus was more on ad-trackers.
It is important to remember that what is ‘strictly necessary’ should be assessed from the user’s or subscriber’s point of view, not your own. So, for example, whilst you might regard advertising cookies as ‘strictly necessary’ because they bring in revenue that funds your service, they are not ‘strictly necessary’ from the user’s perspective.
Updated February 19, 2020: A new update from the CNIL states that A/B testing and audience measurement are now exempt from consent.

Therefore, active and informed consent is required for placing cookies and profiling technologies (like fingerprinting), including advertising cookies (but not strictly necessary cookies).