On June 5, 2012 new Dutch legislation on the use of cookies entered into force. This new regime, which introduces a requirement for informed consent based on an opt-in system, has major implications for online advertising companies focusing on Dutch customers. To implement Directive 2009/136/EC [ePrivacy Directive], the law regarding cookies in The Netherlands has now been revised to include a consent that should be given explicitly by the internet-user in cases of "third party" and "tracking cookies". The same requirement of explicit consent applies should a provider want to place cookies for online behavioural advertising purposes.
There has been a lot of debate about the question how consent can be obtained. The legal requirement is that consent should be given specifically, freely and knowledgeably. Moreover, the explanatory notes to the adopted Dutch amendment state that consent has to be "unambiguous". This would be a stricter requirement than laid down in the ePrivacy Directive and seems to exclude the option of giving consent through browser settings. Although Dutch government has confirmed that there is, in principle, no need for unambiguous consent in this regard, it is really up to a judge to interpret this new set of laws and determine its scope. However, this does not alter the fact that it is certain that an interpretation that leads to the requirement of unambiguous consent per se may be in violation of the ePrivacy Directive. This is due to the fact that the Directive does not demand unambiguous consent and it concerns full harmonisation instead of minimal harmonisation.
When it comes to "first party cookies" (used to recognise a specific browse /computer combination), if one was to return to the same site, only consent, as opposed to the unambiguous consent, will be needed. Consent through browser settings will be considered sufficient in this regard. The parliamentary documents also clarified that the relevant obligations lie with the party responsible for setting the cookies and the rules on cookies also apply to less traditional automatic gathering tools such as flash cookies, java-scripts and spyware.
Based on the above one could in fact describe this new Dutch legislation as a real Cookie Monster, leaving cookies almost with no chance to survive. This being said, we advise that you use a pop-up screen or a bar with information about cookies, or a hyperlink via which this information can be easily accessed and a tick-box is provided to obtain consent. As a precaution, it is also advisable to notify the Dutch Data Protection Authority about cookies that will process personal data.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
