New ÚOOÚ recommendation on cookie bars
The Office for Personal Data Protection (ÚOOÚ) has provided answers in another series of frequently asked questions concerning personal data processing. This time, it turned its attention to cookie bars for granting consent to the use of cookies and the subsequent processing of personal data. The ÚOOÚ recommendation settles some contentious issues and provides specific information relevant for all website operators.
According to the Office, websites with non-technical cookies do not need to display a cookie bar or require consent to the GDPR if they serve only to ensure the basic functioning of the website. However, if personal data are collected via technical cookies, the relevant information obligation must be fulfilled in another appropriate way.
Another important piece of information is that website users must have an option to refuse the storage of cookies at the first level of the cookie bar, as is usually the case with consent. Consent must be granted through an active action and cannot be valid if obtained in a pre-set form within the browser. In addition, the consent button must not be favoured over the opt-out button, for example by its size or unusual colouring. Furthermore, the displayed cookie bar must not prevent visitors from browsing the website.
Closing the cookie bar cannot be considered consent, and if consent is explicitly refused, it may not be required again for at least 6 months, except in cases where the circumstances of processing have changed. Finally, website operators must provide the possibility to withdraw consent via a button or link on the website.
The recommendation of the Office for Personal Data Protection is available in Czech in its entirety here.
