GDPR aims to protect the personal data of EU citizens and residents. Therefore GDPR applies if your companies are outside the EU and collects data from EU residents visiting your company's website. Unless you manage to block access to your website from EU users, you have to collect and store valid consent to comply with GDPR.

If your website does not set any cookies, you are not collecting any personal data from your users. In this case, you do not need to collect consent. However, this rarely applies, and unless your website only uses "technical necessary" cookies, you would need a consent solution to collect valid consent from your users.

Yes. It is not allowed to set any non-necessary cookies before consent. For that reason, cookies need to be blocked before a user gives consent.

To live up to the new guidelines from the Danish DPA (Datatilsynet), you will have to choose one of the following templates: Overlay v2 or Overlay v3. You can preview them here. "Overlay V2" is the most updated consent popup design version, fitted for the most strict interpretation of the regulations and laws covering cookie consents on websites. It also complies with the latest availability standards.

GDPR does not directly mention cookies or websites but talks about personal data processing. Since most cookies collect personal data for processing, their use is subject to the GDPR.

GDPR specifies the need for informed consent: consent must be given by a clear affirmative act establishing a;

…indication of the data subject's agreement to the processing of personal data relating to the user.

To be compliant, you need to pass the following six tests:

*If you fail one or more of the above, you are not compliant with GDPR and ePrivacy.

Yes. GDPR stays that consent must be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous agreement to the processing of personal data. A free choice implies the ability to choose 'yes' or 'no' to cookies collecting personal data, which is reflected in the 'accept' or 'decline' button.

Cookie Information stores consent data in the servers hosted by Microsoft Azure.

Cookie Information's servers are stored in The Netherlands, EU.

None. A sub-processor is any other business or contractor that the personal data of users may go through. We do not collect or store any personal data to run and provide our services.

Yes, if you asked for valid consent from your users and they accepted cookies.

No, when a user declines cookies on your website, all non-technical necessary cookies should be held back. That would result in you not collecting any personal data so that you are compliant with GDPR.

When using Google Fonts, the user's browser is transferring their data when calling to Google's servers to retrieve the necessary information for the font - this includes the user's IP Address. As Google uses CDNs in various countries, this could mean that the data will be sent outside of the EU.

As there is no cookie set, we would recommend that you self-host the desired font(s) on your own web server to ensure that you remain compliant and in no violation of the EU data privacy laws.

This ruling means that all transfers of personal data to the US before relying on Privacy Shield are non-compliant.

There has not been given any grace period, but we will not expect any immediate action. However, from this point, data controllers will need to find another legal basis for the transfer.

Secondly, the CJEU validated the use of standard contractual clauses (SCC), which is one of the other ways data controllers can obtain a legal basis for data transfers.

The above, however, gives data controllers additional work and, in some cases, a false sense of security as this requires the data controller to assess data protection levels of the transfer to the US.

Data controllers must assess and see if the vendor in the US maintains a level of protection that is essentially equivalent to the one guaranteed by the GDPR. In a country for which the CJEU has assessed that the data protection levels are not adequate.

It would be beneficial for data controllers to seek the options of SCC, as this can be a valid and more straightforward task for your legal team.

If SCCs are not possible, here are the following approaches:

Cookie Information gives an overview of the website's data transfer. By accessing the compliance dashboard, you can monitor data transfer for your website. Looking at the data provided by the compliance dashboard will be the stepping stone for anyone who wants to deal with the situation outlined above.
​

Easily visualize to what countries cookies on all of your domains send data and locate potential privacy risks. The Compliance Dashboard updates daily and gives you an accurate insight into your website's cookies.

If you are already a client and are curious about obtaining the professional compliance dashboard, please write to us at support@cookieinformation.com.

Google has published an updated EU user consent policy which includes strict and prompt suspension of Google accounts due to non-compliance.

This means that Google now will audit websites and suspend the use of Google Services if appropriate consent from users in the European Economic Area and the UK for the use of cookies or (in the case of remarketing) the use of personal data for personalized ads is not obtained.

Google started enforcing the new policy on May 11, 2022, and we see audits being carried in scale.

The following services are subject to Google's EU user consent policy:
​

Google Analytics

Google Ads

Google AdSense

Google Ad Manager

Google Maps

YouTube API Services

reCAPTCHA

Blogger

The DPA mentions the ability to conduct physical audits. Remote audits can be conducted too, free of charge, if they are within reason.

However, if the audit becomes very extensive and requires further investigations or legal assistance, we will bill on an hourly basis.
​

Related articles: