Quantcast
return Home

EU Commission proposal may kill the 3rd party cookie

Johnny Ryan ()

A proposal this month from the European Commission to reform the ePrivacy Directive (ePD) requires mandatory privacy options and educates users to distinguish between 1st and 3rd-parties in a way that will make 3rd-party cookies extinct, writes Dr. Johnny Ryan, head of ecosystem, at PageFair.

This article is reproduced here with thanks to PageFair. The original version is here.

The Commission’s proposal also applies beyond cookies. The proposed reform of the ePD will further add to the the disruption that Europe’s new regulatory regime for privacy – the GDPR – will wreak upon to the media and advertising landscape when it applies in May 2018. (But bear in mind this) Caveat: the proposal is subject to negotiation between the Commission, the European Parliament, and the Council of Ministers. Its text may change before it becomes a regulation across the European Union.

Mandatory and binding privacy settings

Web browsers (and similar software) will be required to prompt users with a menu of privacy options when they are installed for the first time.[1] The menu options will range from an extreme ban on all cookies to acceptance of all cookies, and will include intermediate options such as “reject third-party cookies” or “only accept first-party cookies”.[2] This is mandatory – a user must select one option from the menu in order to continue with the installation.[3] And unlike previous initiatives such as the Do Not Track standard, the Commission says that user’s privacy menu choice will be “binding on, and enforceable against, any third-parties”.[4] This does not apply only to newly installed software, but also to browsers already in operation before the new rules are introduced. (These must be updated to comply no later than 25 August 2018).[5] 

In other words, at a point in 2018 there will be no browser installed in Europe that does not have legally binding privacy settings that have been selected by a user.

Users will distinguish between 1st and 3rd-parties

The Commission had previously considered forcing web browsers vendors to reject all 3rd-party cookies by default, and giving users the ability to opt in to 3rd-party cookies if they wished.[6] The approach adopted in its final proposal appears less severe than this privacy-by-default approach, but will probably have the same consequence. The mandatory menu will educate users in a way that will cause a widespread rejection of 3rd-party cookies.

There are several measures in the proposal that will cause users to distinguish between 1st and 3rd-party tracking.

First, web browsers will be required to present the privacy settings options to users in a manner that educates them about “the compilation of long-term records of individuals browsing histories and the use of such records to send targeted advertising”.[7] Few users could be expected to willingly opt in to this. The inclination to say no will be compounded by users’ dawning awareness of the data collected about them, the uses to which these data are put, and the extent to which these data are breached, that will result from transparency requirements in the General Data Protection Regulation.[8]

Second, the Commission Proposal requires web browsers to present the higher privacy settings in a manner that does not dissuade users from selecting them.[9] 

Third, users who select lower privacy settings at first installation of a web browser will have controls to allow them to apply privacy controls on specific websites if they wish,[10]  so there could be a gradual fall off.

Finally, The proposal requires that users who have consented to their data being processed are reminded every six months that they can withdraw their consent any time.[11]

Beyond cookies

The proposal encompasses tracking measures beyond cookies. The Commission regards peoples’ devices, and data flows to and from those devices, as part of the private sphere.[12] As a result users’ prior consent is required for tracking cookies, hidden identifiers, and “other similar unwanted tracking tools can that enter end-user’s terminal without their knowledge in order to gain access to information, to store hidden information and to trace the activities of the user or to instigate certain technical operations or tasks…”.[13] Remote collection of data in order to identify and track users, such as device fingerprinting, is explicitly included among the proposal’s prohibitions.[14]

Where and how this applies, litigation and penalties

Once negotiated between the European Commission, the European Parliament, and the European Council, the overhaul of the ePrivacy Directive will be directly transposed into the national laws of every nation in the EU.

The EU is the world’s largest single market.It will impact much of the martech and adtech sector because businesses outside the EU that provide service to users in the EU will have to have a representative in the EU[16] who will be addressable by supervisory authorities.[17] However, beyond the EU the ePD may have less impact than the GDPR. Its territorial scope covers communications within the EU and services to end-users in the EU irrespective of where the processing occurs in the world.[15]

The range of fines for infringements is similar to the GDPR.[18] For example, failure to comply with an order from a supervisory authority will be subject to a fine of up to 20 million or 4% of global turnover.[19] 

There is also reason to anticipate litigation. As with the GDPR, end users can both complain to regulator and seek redress in court against an infringement,[20] and users have a right to receive compensation for damage.[21] Users can also take the regulator to court if unhappy with their action or inaction. Users can also mandate privacy organizations to lodge a complaint and to seek redress in court on their behalf (and Member States may decide that bodies can do so without users mandating it). Any other party that is adversely affected by infringements can bring legal proceedings.[22] 

In short, the proposed ePD has teeth.

For more insights from Johnny and PageFair sign up to PageFair Insider at http://eepurl.com/bnJgfP.

Johnny will also be at the 41st FIPP World Congress in London, 9-11 October 2017. Meet him there.

More like this

Four big ideas emerge from PageFair global stakeholder roundtable

Pagefair’s Johnny Ryan on the growth of the blocked web

  • John Wilpers showcases top trends included in new FIPP Innovation World Report Messaging apps and chatbots are two of the main developments media should be paying a lot more attention to than is already the case, John Wilpers, Innovation Media Consulting senior US director and author of FIPP’s annual Innovation World Report, said at Digital Innovators’ Summit in Berlin today as he shared top media innovations from around the world. 20th Mar 2017 MagWorld
  • How to develop your chatbot strategy

    If you have Alexa, Amazon’s intelligent personal assistant, then you probably start your morning with a conversation with a chatbot. Because let’s admit it: chatbots are already everywhere. On the one hand, we love to hate them because they are, well, not human. On the other, we love to love them because they create an interactive and personalised experience. Brands have been quick to adopt this technology. Too many media companies lag behind experimenting in this field.

    16th Mar 2017 Insight News
  • Video strategies for a visual world - with AJ+ and AwesomenessTV Unsurprisingly, a hot topic for many of the speakers at this year’s Digital Innovators’ Summit is audience engagement via video. On day one of the conference, Alan Saura, audience development strategist at AJ+, focused his talk on how to maximise audience engagement using video and social media. Meanwhile, chief digital officer at AwesomenessTV, Kelly Day, explained how the company harnesses the unique attributes of Generation-Z (those aged between two and 21 at present) to create content that really speaks to this young but powerful audience. 20th Mar 2017 MagWorld
  • Monetising content - from distribution to subscription Diversifying revenue streams is naturally on top of the to do list of the execs of most publishers. It is a topic that was widely covered at DIS 2017 with a number of speakers addressing the issue of monetisation from a number of differing perspectives on Day 1 and Day 2. 21st Mar 2017 MagWorld
  • Platforms as mass media, magazine media as niche and ‘why you should not outsource your future’ Published content drives daily news consumption and engagement on platforms all over the world. They (platforms) have become the new mass media. Magazine media are now in the niche media business, according to Grzegorz (Greg) Piechota, research associate at Harvard Business School and 2016 Nieman Fellow, presenting at Digital Innovators’ Summit yesterday in Berlin. 21st Mar 2017 MagWorld

SUBSCRIBE

FIPP newsletters allow you to keep up with industry trends, research, training and events across the world

FIND OUT MORE

SHARE YOUR NEWS

Get global coverage of your launches, company news and innovations

FIND OUT MORE

Upcoming @ FIPP

What’s happening now, what’s coming next

Go to Full Site