The E-Privacy Regulation has been the bugbear of European advertising industry for years. The Council of the Union is discussing a new draft – with significant implications for marketing and tracking. A legal classification. An essential legislative project in data protection is the planned E-Privacy Regulation.
In addition to the general requirements of the General Data Protection Regulation (GDPR), this should or should have long since made area-specific regulations for handling personal data. Tracking is affected by this, for example. The Council of the Union has now published a new draft for the E-Privacy Regulation.
E-Privacy Regulation: Prehistory
Once again for classification: The currently valid E-Privacy Directive is also known as the “Cookie Directive.” It should have been revised long ago and adapted to technological developments.
After all, the original version dates back to 2002. The first draft of the E-Privacy Regulation from 2017 stipulated that it should be applied with the GDPR on May 25, 2018. That was a plan that was almost impossible to keep from the start. The new regulations in the E-Privacy Regulation are so relevant because they affect a wide variety of economic sectors. It starts with telecommunications.
The same applies to the advertising industry. Finally, there are guidelines for email marketing, data from networked and smart end devices, and end-user tracking. More precisely, it is about accessing the information on user devices, such as laptops or smartphones. Therefore, the E-Privacy Regulation also contains essential specifications for the use of cookies, pixels, or other tracking methods.
New Changes In The Privacy Regulation
The draft of the Council Presidency that has now been published contains some practical adjustments compared to a version of the Croatian Council Presidency from March 2021. The draft provides that access to information in a user’s device or the use of storage options in the device should be possible without consent if this is technically necessary to provide a service that the user expressly desires.
The requirements that access is “technically” necessary have been added. Also new is that the user “expressly” requests the service. With both new requirements, the scope of this exception provision is narrowed to the basic rule that the user’s consent must always be obtained.
On the one hand, in case of doubt, companies would now have to prove that access to information in a device or the use of storage capacity was technically necessary. Or, to put it another way: Without this access, the service that the user requests should not work. In addition, a user’s behavior must make it very clear (“explicitly”) that he wants to use a specific service.
Simply continuing to surf on a website could not be considered specific enough in this regard to load various functionalities of a website that require the use of cookies, for example. From the point of view of companies, both changes result in stricter requirements.
The “Legitimate Interest” Has Disappeared
As an exception to the consent requirement, this standard provides access to end devices, and thus the use of cookies should be possible if a weighing of interests shows that the user’s claims do not conflict with this. Therefore, the current draft of the Council Presidency no longer provides for the possibility for companies to carry out tracking on websites or in apps for advertising purposes based on a weighing of interests.
Accordingly, the former recital 21b was deleted, in which it was still provided that companies can also consider financing their free online offer via advertising tracking as a “legitimate interest.” This adaptation of the E-Privacy Regulation massively restricts the tracking options for companies without the user’s consent if the purpose of the tracking is to market their online offer.
Conclusion On The E-Privacy Regulation
From the point of view of the advertising industry, the adapted draft of the E-Privacy Regulation is unlikely to meet with much enthusiasm. At least compared to the previous state of negotiations. It remains to be seen whether this is the last word. The new draft will be discussed in the Council on November 11, 2021. Then it should also be about further work on this critical project in general.
ALSO READ: Artificial Intelligence Of Things: How IoT Systems Become Competitive
