Italian Garante published updated cookie guidelines. What is Garante? How to deal with the Italian DPA Cookie Guidelines? Learn about it here!
Italian Garante published updated cookie guidelines. What is Garante? How to deal with the Italian DPA Cookie Guidelines? Learn about it here!
The Italian Data Protection Authority (Garante per la protezione dei dati personali, or simply Garante) is an independent authority set up to protect fundamental rights and freedoms in connection with the processing of personal data, and to ensure respect for individuals' dignity.
The Italian DPA adopted a resolution, on 8 May 2014, about the simplified arrangements for information notices and obtaining consent for the use of cookies. Since then, there have been several amendments to the applicable legal framework in Italy, including the entry into effect of the EU General Data Protection Regulation (GDPR).
Explore more privacy compliance insights and best practices
On 10 June 2021, the Garante published its updated guidelines concerning cookies and other tracking tools (Cookie Guidelines). The Cookie Guidelines aim to ensure that website owners comply with both the GDPR and the ePrivacy Directive.
The Guidelines make it clear that they apply not only to cookies but also to other tracking tools such as fingerprinting (collectively “Cookies”). The Italian DPA divides cookies into “technical” cookies and “non-technical” cookies. Technical cookies (also referred to as “strictly necessary cookies”) are those used solely for the purpose of “carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the contracting party or user to provide that service”. On the other hand, non-technical cookies can be used for several purposes including tracking users and sending targeted advertising messages.
According to the Italian DPA Cookie Guidelines, you must:
1. Obtain consent before setting non-technical cookies.
Cookies and other tracking tools serving purposes other than the technical ones may only be used after obtaining informed consent from the user.
2. Users visiting your site for the first time must be shown a cookie banner.
This cookie banner should be clearly distinguishable from other components of the website. The banner should contain
1) an “X” button at its top-right which when clicked should close it without placing any cookies other than the technical cookies;
2) a minimal information notice which contains information about the cookies and purposes;
3) a link to the privacy policy which should be one-click away containing information about all the elements of Article 13-14 of the GDPR;
4) a command (button) through which consent can be given by accepting the storage of all cookies; and
5) a link to a dedicated area where users can make informed choices about which cookies, third parties, and functionalities to allow.
3. Scrolling cannot be relied on as a means of valid consent.
In line with the view of most EU data protection authorities, the Italian DPA also considers that mere scrolling down of the page bar cannot equate to obtaining valid consent. However, Garante states that in some instances scrolling may be used as a means of obtaining valid consent. This is the case when scrolling is one (and not the only) component of a more complex process that allows users to flag his/her informed and unambiguous choice, which can be recorded and documented.
4. Cookie walls are illegal.
Cookie walls are not permitted under the guidelines of the Italian DPA, except for the cases where the website controller provides the data subject with the option of accessing equivalent content or services without giving his or her consent to the storage and use of cookies or other tracking tools.
5. Analytics cookies can be used without consent only when it is not possible to single out a data subject.
Analytics cookies can be considered technical cookies under strict conditions. In order for analytics cookies to be treated as technical cookies, it is essential to prevent direct identification of the data subject, or, in other words, keep your users anonymous.
6. At least 6 months must elapse before you can show your cookie banner again.
When a user has made his/her choice regarding the cookies you cannot repost cookie banners repetitively. You must ensure that at least a 6-month period has elapsed before you can re-present the banner to the same user. However, there are exceptional situations which are 1) if one or more of the circumstances of the processing changes significantly, and you need to inform users exactly about the changes, and 2) the user has deleted the cookies lawfully stored in his/her device and the controller is no longer able to keep track of the user’s intention concerning the placement of cookies. Take a look at some GDPR cookie banner examples.
Read our blog to get a simplified breakdown of the latest EDPB Cookie Consent Guidelines.
Secure Privacy’s GDPR compliance solution is packed with enterprise-level features such as;
Book a 30-min call today and get a quick ‘check-up’ of your website, cookie consent banner, or your cookie policy from a data privacy expert.
Schedule a call to learn more
Italian DPA official website
Italian DPA Cookie Guidelines
Check out the other Cookie Consent Guidelines from other European Data Protection Authorities that you may need to comply with as well;
