Leave complex privacy compliance
to ITLINE CMP

Cookie banners are, in practice, a necessary or effective means of complying with cookie-related requirements under domestic and international data-protection and privacy laws. Below we introduce considerations under EU law, California (CCPA), and Japanese law.

Installing a banner as a mere formality does not necessarily mean you are compliant. The banner must actually enable you to meet the legal requirements. For example, under EU law, the following situations may fall short:

• Cookies are used for visitors who have not consented via the banner.
• Cookies continue to be used for a user after they have withdrawn consent.
• Consent is obtained via deemed/implied consent (e.g., pre-ticked boxes).

Under EU law, the ePrivacy Directive generally requires prior consent to use cookies.

Exceptions apply where a cookie is strictly necessary for transmitting a communication or for providing a service explicitly requested by the user — in practice, these are known as "strictly necessary cookies."

The consent must be freely given. Default-on settings or blanket consents are not permitted. In practice, cookie banners are used to obtain freely given consent from site visitors.

Our service enables website owners to meet these requirements.

Under EU law, consent is typically obtained using a cookie banner, cookie preferences page, and cookie policy.

First, the banner presents visitors with a summary of cookie usage and asks for consent. It must allow granular consent by cookie category — so in addition to accept/reject buttons, a preferences button and a link to the cookie policy are required.

In practice, cookies are broadly classified as:

• Strictly necessary cookies
• Performance cookies
• Functional cookies
• Targeting cookies

Under GDPR, cookies alone constitute personal data, and any processing requires a legal basis.

For cookies, the applicable bases are typically "consent" or "legitimate interests."
If relying on consent, the banner must obtain valid consent.
If relying on legitimate interests, the privacy policy must describe that fact and the nature of the interests, and users must be properly notified.

When personal data is collected from users directly or indirectly, the privacy policy must — where applicable — include information such as:

• Identity and contact details of the controller (and representative, if any)
• Contact details of the DPO
• Purposes of processing and the legal basis
• Recipients or categories of recipients of the personal data
• Relevant information where personal data is transferred to third countries
• Retention period (or the criteria used to determine it)
• Data subject rights
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority
• Whether the provision of data is a statutory/contractual requirement
• Possible consequences of failing to provide the data
• Categories of personal data concerned
• Source of the personal data
• Existence of automated decision-making, the logic involved, and its significance for the data subject

A link to the privacy policy should be placed on the cookie banner.

CCPA generally does not require prior consent to use cookies.

However, "no consent required" does not mean "nothing to do."
Because cookies alone are personal information under CCPA, the following are generally required:

• Provide sufficient notice at the point of collection (via privacy policy, etc.)
• Where personal information is "sold" or "shared," enable users to exercise their right to opt out — specifically, honor opt-out preference signals and provide a "Do Not Sell or Share My Personal Information" link/form.

Our service enables website owners to meet these requirements.

CCPA requires the privacy or cookie policy to clearly state at minimum:

• Categories of personal information collected
• Purposes for which it is used
• Whether it is "sold" or "shared"
• Retention period (or criteria used to determine it)
• Rights available to users (e.g., opt-out)
• How to exercise opt-out rights

CCPA requires notice at collection as described in the preceding Q&A.

Our service can display a link to the notice at collection on the cookie banner.

The notice must also:

• Avoid technical or legal jargon — use plain language
• Be readable on mobile and small screens
• Meet accessibility standards for users with disabilities

* These aspects must be addressed by the website owner.

Where personal information is "sold" or "shared," CCPA requires safeguarding users' opt-out rights.

Specifically, a "Do Not Sell or Share My Personal Information" link or button must be placed on the banner, and selecting it must immediately stop the sale/sharing.

Opt-out preference signals sent by browsers (e.g., Global Privacy Control) must also be honored automatically — without requiring further user action.

Our service supports opt-out preference signals and can display a "Do Not Sell or Share My Personal Information" link on the banner.