Cookie Policy
What is the Cookie Directive (EU Cookie Law)?
The Data Protection Directive – also known nationwide as the “Cookie Directive” – is a European directive (ePrivacy Directive) from 2002 – revised in 2009 – which has been implemented into national law in the European member states.
If you own a website or an online store, you are subject to the requirements of the privacy laws as interpreted by your country of residence, regardless of whether your website is privately owned or owned by a company or public authority.
The data protection guidelines state that all websites in the EU must obtain the consent of their visitors to store cookies on users' computers or smartphones (devices).
Who does the Cookie Policy apply to?
If your website uses cookies (first-party and third-party cookies), you are responsible for informing your website visitors about your use of cookies. You must do this explicitly in a cookie consent banner.
In addition, you must collect and securely store your users’ consent to cookies (up to 5 years).
The storage of consent is necessary and must be verifiable in case you are subject to an inspection or have to respond to a request for information about personal data from the state data protection authority.
Remember that the requirements for the collection and processing of personal data have been tightened with the General Data Protection Regulation (GDPR).
This is what the EU Cookie Directive says
In the European Union, Directive 2009/136/EC was intended to guarantee and strengthen the protection of personal data during website visits. The EU Cookie Directive, adopted in 2009, was supposed to be implemented by all member states by 2011 at the latest – which, however, did not happen.
The cookie policy essentially stipulates that website visitors must be informed about the use of cookies in an easily understandable way and must consent to their storage. According to the policy, cookies may only be set without prior consent if they are technically necessary – for example, to provide a service requested by the user. This includes session cookies for storing language settings, login data, and shopping cart contents, or Flash cookies for playing media content.
For most cookies, however, website operators need user consent. This applies to all cookies that are not technically necessary for the website to function. This includes, in particular, advertising cookies used for retargeting , but also analytics and social media cookies. The EU directive, however, does not specify exactly how these requirements are to be implemented. Uncertainty prevails, especially regarding the consent declarations of website visitors.
Contents of the current EU Cookie Directive
The European Union aims to better protect the personal data of internet users with its Cookie Directive . The EU fundamentally distinguishes between technically necessary and non-essential cookies:
- Technically necessary cookies: Necessary data storage includes cookies that are absolutely necessary for the functions of a website. This means, for example, saving log-in data, the shopping cart or the language selection using so-called session cookies (which are deleted when the browser is closed).
- Technically unnecessary cookies: Non-necessary cookies are text files that are not only used to ensure the website works, but also collect other data. These include the following:
- Tracking cookies
- Targeting cookies
- Analysis cookies
- Cookies from social media websites
According to the cookie directive , necessary cookies may be set from the outset, even without prior user consent . In contrast, website visitors must consent before cookies can store non-essential data. Therefore, the EU cookie directive, as generally understood, requires an opt-in solution for non-essential cookies.
This is the difference between opt-out and opt-in:
- Opt-out: Cookies are set from the beginning – users can only subsequently object to data storage.
- opt in: Cookies are not set from the beginning, but only when the user agrees to the data storage.
