Cookies in Italy: New guidelines to protect users

published on 3 August 2021 | reading time approx. 2 minutes

On 9^th July 2021 the Italian Data Protection Authority has published the new Guidelines on cookies, which introduce important impacts for all sites, apps, devices and platforms, including e-commerce, that use cookies and fingerprinting. Organizations will have six months (until 9 January 2022) to comply. The following points should be highlighted as a recap of the main changes.

Legal foundations

Legitimate interest cannot be a valid condition of lawfulness for cookies, not even for technical cookies. It would seem, therefore, that more importance is attached to the instrument than to the purpose. Therefore, if, for instance, through a cookie one intends to pursue a purpose brought under the legitimate interest (e.g. prevention against frauds and abuses) that cookie cannot be under the legitimate interest but be detached by default, with consequent need to review the condition of lawfulness of such purpose. This remains an open point.

Technical cookies

If only technical or analytical cookies, similar to technical cookies are used, information may be provided on the homepage or in the general information notice without the need for specific banners to be removed by the user.

Banner

It does not always have to be repeated at each new access by the user, even when the latter has freely chosen to do so, unless:

• one or more conditions of processing change significantly, as in the case of a change of third party;
• it is impossible for the website operator to know whether a cookie is already stored on the device (e.g. in the event that the user chooses to delete cookies legitimately installed on his device without the owner being able, therefore, to keep track of the user's wish to maintain the default settings and thus continue browsing without being tracked)
• at least 6 months have elapsed since the previous presentation of the banner.

Reject "X"

If profiling cookies or other tracking systems are also present under the authorization, in order to maintain the default settings (only technical or assimilated technical cookies are active), the user must be given the opportunity to refuse by entering an X in the banner at the top right.

Retention

In any case of re-proposition of the banner containing the short information and the user's choice options, as well as where the user modifies the choices originally made, the negotiation choices made during subsequent accesses shall overwrite the previous ones and be, therefore, considered as a modification of the previous options, indifferently, in terms of provision/revocation of consent.

Colors and buttons

It is important, to ensure that users are not influenced or penalized by design choices that lead them to prefer one option over another, to use controls and fonts of the same size, emphasis and color, which are equally easy to view and use.