Cookies

Also known as: Cookie, Cookie Consent, Cookie Banner, Çerez

In short

Small text files that websites place on the user's device and read on later visits; apart from strictly necessary cookies, explicit consent is generally required.

Cookies are small text files that a website places on the visitor’s device and can read on later visits. They are used to keep sessions open, remember shopping baskets, measure visitor statistics and personalise advertising. Information obtained through cookies is personal data to the extent it can be linked to a person. Similar tracking technologies such as pixels and SDKs are subject to the same rules.

Types of Cookies

Strictly necessary cookies: Those strictly required for the site’s core functions and the service the user requested.
Functionality cookies: Those remembering settings such as language and preferences.
Analytics cookies: Those measuring visitor behaviour.
Advertising and targeting cookies: Those personalising ads; see Targeted Advertising with Personal Data.

A distinction is also made between first-party cookies placed by the site itself and third-party cookies placed by advertising networks and analytics providers.

The Authority’s Cookie Guide

Under the Guide on Cookie Practices published by the Personal Data Protection Authority in 2022, strictly necessary cookies do not require explicit consent. Non-essential cookies should generally rely on explicit consent and must not be placed before consent is obtained.

How Consent Should Be Obtained

Consent must be obtained by an active action; pre-ticked boxes must not be used.
“Accept” and “reject” options must be equally easy and visible.
Users must be able to choose for each category and withdraw consent as easily.
Continuing to use the site or closing the banner is not consent.

Cookie banners hiding the reject option are also considered dark patterns. If third-party cookies send data abroad, cross-border data transfer rules also apply. Cookies used must be explained in the cookie policy.

Frequently Asked Questions

Do analytics cookies also require explicit consent?

Under the Authority's Cookie Guide, the strictly necessary exception is interpreted narrowly; analytics cookies measuring visitor behaviour should usually rely on explicit consent. If the analytics tool sends data to a provider abroad, cross-border transfer rules must also be considered.

Is "by continuing to use the site you accept cookies" enough?

No. Continuing to use the site is not explicit consent. Consent must be obtained by an active statement, with cookie categories shown separately, and rejecting must be as easy as accepting.

← Glossary A–Z