The European Commission has recently introduced the draft of the so-called ‘cookie pledge’, a legislative proposal aimed at regulating the profiling of users on the internet via cookies. This initiative, based on voluntary compliance by companies, aims to improve clarity and transparency in the management of cookies.
The guiding principle of the draft is to address the problem of irrelevant and unclear information in cookie banners. The proposal aims to eliminate those situations where the user is asked to choose, for example, between profiling according to consent or according to the legitimate interest of the company. The latter option, in fact, has never had a valid legal basis, misleading many users in recent years. The Commission also aims to reduce ‘cookie fatigue’ by limiting the repetition of similar banners to once a year and allowing the use of third-party applications to manage data preferences.
But the crucial aspect to be regulated is undoubtedly the so-called ‘pay or leave’, i.e. the choice between paying to access the site or abandoning it. This dynamic is emerging more frequently on the web, as the business model based on user profiling for advertising has become progressively unsustainable. The transition to a pay-as-you-go system, similar to what happened recently with social media, is therefore a response to the decreasing profitability of advertising. On this point, the Commission aims to provide clarity in the banners, with concise explanations of how the site monetises through profiling and the indication of alternatives such as subscriptions. An important novelty in this respect, compared to what we have seen so far in recent years, will be the obligation for sites to offer a third way, with less invasive advertising, in addition to the paid version and the one with advertising profiling. In this sense, the board of European data protection authorities, the EDPB, proposes as an alternative that of contextual advertising, linked to the context in which it is used, representing a compromise between targeted and generalist advertising. On this point, the measure of the Italian Data Protection Authority is also awaited, precisely because of the practices of newspapers that were among the first to adopt the ‘pay or leave’ modality, which in itself is not illicit and which, indeed, in some ways, saw an opening by the European Court of Justice in its July ruling.
This intervention becomes more crucial considering the uncertainty over the approval of the EU’s e-Privacy regulation, which has been at a standstill for years. It is sad to have to denote, in this case, the inadequacy of the European legislator who, having started off on the right foot, is raising the white flag in the face of a piece of work that should have seen the light of day at the same time as the GDPR came into force six years ago. The current proposal is, moreover, merely a stopgap measure, given the voluntary approach, and will contribute to the current regulatory fragmentation among Member States, with the consequence that each Supervisory Authority will continue to proceed autonomously, which is not the solution that companies and users should aspire to.
Add to this the fact that Google has already begun its test phase for a cookie-less system, with a planned entry into force, definitively, in the second half of the year. The system will not authorise third-party cookies by default, guaranteeing more privacy for users, but without having an impact on advertising sales. But this may not be the end of it. A default choice in this sense at browser level, especially coming from Google, could open the way to measures by the Antitrust Authority, with possible profiles of abuse of dominant position if other advertising players were to be affected.
At the moment, the Commission envisages further discussions with companies, with the aim of presenting a final version at the Consumer Summit in April 2024.
