Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

We know trademarks. With a team of more than 25 lawyers, including Professor J. Thomas McCarthy, world-renowned author of the well-respected McCarthy on Trademarks and Unfair Competition, we are a one-stop practice for guarding valuable business assets.

Trademark

Band 1: Intellectual Property: Trademark, Copyright & Trade Secrets, California

Firm to Watch: Intellectual Property; Trade Marks, Copyright And Design

Firm to Watch: Intellectual Property: Trademarks: Non-Contentious

Silver: Firms: Enforcement and Litigation, California 

Bronze: Firms: Prosecution and Strategy, California

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Our M&A lawyers represent Fortune 500 companies, private equity firms, investment banks, and privately-held companies in their most high-profile and complex mergers and acquisitions.

Mergers + Acquisitions

M&A Lawyers & Capabilities

Ranked for M&A: Foreign Firms in Singapore

Ranked for Global Corporate/M&A 

Ranked in the “Elite” Category of Corporate/M&A – Nationwide

Ranked for Corporate/M&A – Northern California

Ranked Band 1 for California Corporate/M&A: Deals in Asia

Ranked in the “Highly Regarded” Category of New York Corporate/M&A

Ranked in the “Elite” Category of Corporate/M&A: International

Ranked Band 1 for Corporate/M&A in Japan

Ranked for Corporate/M&A: International in Singapore

Ranked for Corporate/M&A: Hong Kong-based (International Firms)

Ranked for Corporate/M&A: Mid-Market in Germany

Awarded Deal of the Year for Imerys Joint Venture with British Lithium

Two MoFo Japan Deals Shortlisted for M&A Deal of the Year (Premium)

Two MoFo China Deals Shortlisted M&A Deal of the Year (Premium and Midsize)

Five MoFo Lawyers Named to M&A Powerlist

Named a Leading Firm for M&A

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

Social Links: Statehouse v. Smartphone

Federal Court Enjoins California Teen Privacy Law . . . Again

All Your Sale Are Belong to Us - Mitigating IP and Payments Risk in In-Game Economies (Part II – User-Generated Content and In-Game Payment Models)

A New California Digital Content Law Establishes New Requirements for Advertisers and Vendors

California’s Assembly Bill 587 Loses Key Provisions After Legal Challenge from X

In a move likely welcomed by publishers seeking a solution to honoring “sale” opt-outs in the interest-based advertising space, the Interactive Advertising Bureau last week released the IAB California Consumer Privacy Act Compliance Framework for Publishers and Technology Companies. The IAB is the trade association for the digital media and marketing industries, and it developed the Framework to help publishers (i.e., websites) and the online advertising supply chain comply with the CCPA—and particularly with the CCPA’s right to consumer opt-outs of “sales” of personal information.The Framework sets up a system in which a consumer opt-out has the result that the parties in the digital advertising supply chain become limited service providers to the publisher, such that there is no longer a “sale” with respect to those consumers’ personal information. A limited service provider may still serve ads on behalf of the publisher, but those ads cannot involve any “sale” of personal information under the CCPA.IAB is accepting public comments to the Framework until Tuesday, November 5, 2019. Comments should be emailed to <a href="mailto:privacy@iab.com" target="_blank" rel="noopener">privacy@iab.com</a>. The draft Framework and draft technical specifications for the Framework can be accessed <a href="https://www.iab.com/guidelines/ccpa-framework/" target="_blank" rel="noopener">here</a>.The FrameworkRecall that the CCPA gives consumers the right to opt out of “sales” of their personal information, where a “sale” is a disclosure or making available of personal information for monetary or other valuable consideration. Certain types of interest-based advertising may involve a sale because, for example, an advertiser may receive or reap the benefit of information collected on a third-party website in exchange for information collected on its own website—all so that each advertiser can more precisely target its own ads. If there is a sale of personal information, California consumers have the right to opt out of it (or into it, if they are under age 16).As part of the Framework, the IAB is developing a Yes/No signal that a participating publisher can implement in connection with its CCPA “Do Not Sell My Personal Information” link. If a user clicks that link to opt out of the sale of his or her personal information, the “No” signal and accompanying device and browser identifier will be sent to downstream digital advertising parties so that they can effectuate the opt-out. When this happens, the parties in the advertising supply chain will become service providers to the publisher with respect to the opted-out user and then serve to that user only advertising that does not involve a “sale” of the user’s personal information (e.g., contextual ads or certain retargeted ads). The move to becoming service providers is effectuated via a Limited Service Provider Agreement that establishes contractual privity among its signatories—that is, the various players in the online advertising ecosystem, such as the publisher and demand- and sell-side platforms.TakeawayWith the IAB’s introduction of the Framework, we are gaining insight into how some digital advertisers see themselves fitting into a post-CCPA world. Here, the IAB provides for a “limited service provider” relationship between publishers/advertisers and downstream digital advertising parties, which would allow such parties to continue serving ads — but which would not allow the downstream parties to aggregate or use personal information across clients or use personal information for its own purposes. Whether this solution sufficiently addresses the concerns of parties in the digital advertising supply chain remains to be seen as comments are submitted and companies sign on. The Digital Advertising Alliance, among others, is also working on compliance tools for the CCPA, and other compliance solutions may take different stances on salient provisions of the CCPA.To access MoFo’s full suite of CCPA thought leadership and readiness tools, visit our <a href="https://www.mofo.com/special-content/california-consumer-privacy-act/" target="_blank" rel="noopener">CCPA Resource Center</a>.

oneill_julie_blog_150x150.png

oneill_julie_common_640x280.jpg

oneill_julie_heroretina_2700x1160.jpg

oneill_julie_mobileretina_750x1040.jpg

oneill_julie_social_600x600.jpg

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance c

Julie O'Neill

Clients seek out Julie because of her practical advice on cutting-edge issues at the intersection of privacy and consumer protection laws. She provides clients with practical solutions to compliance challenges around a wide variety of both online and offline privacy issues, including tracking, interest-based advertising, geo-targeting and other mobile tracking, personalization, and cross-device tracking. Recognized in The Legal 500 US 2014, 2016, 2019, and 2020 and Chambers USA 2021 for her exceptional legal work, her clients praise her saying, “She is really good at giving practical, targeted advice and taking stock of what the risk profile of the client is, so that the advice is holistic.” (Chambers USA 2021).

gettyimages-1174491741_small-300x227.jpg

We’re Sorry, Your Service (Provider) Is Limited: The IAB CCPA Compliance Framework

We’re Sorry, Your Service (Provider) Is Limited: The IAB CCPA Compliance Framework

In a move likely welcomed by publishers seeking a solution to honoring “sale” opt-outs in the interest-based advertising space, the Interactive Advertising Bure

One of the most recent chapters in the ongoing EU cookies saga has come in the form of a recent ruling by the Court of Justice of the European Union (CJEU) in the <a href="http://curia.europa.eu/juris/document/document.jsf;jsessionid=63307BE55F72BCA9701B6A79646E9764?text=&docid=218462&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2219854" target="_blank" rel="noopener">Planet49 case</a>. The CJEU ruled that:(i) implied consent is not sufficient anymore, requiring website operators to seek active consent from users which cannot be obtained by means of pre-ticked boxes; and(ii) any obtained consent will only be sufficiently informed if an average user can understand what cookies do and how they function.The outcome of the case – while pivotal – does not come as a surprise considering the cookie developments in the EU over the past few years.In 2003, when the current Privacy and Electronic Communications Directive (<a href="https://epic.org/international/eu_privacy_and_electronic_comm.html" target="_blank" rel="noopener">ePrivacy Directive</a>) came into effect, the use of cookies and similar technologies was not as advanced as it is now and did not process users’ personal information in the same way and with such complexity. Sixteen years later, cookies and similar technologies have become an indispensable part of almost every business. The amount of useful details that companies learn about their users’ interests and internet behavior through such technologies is vast and seemingly unlimited. As you would expect with such rapid technological development, the EU data protection authorities (DPAs) have caught on that the technologies are a data goldmine.While the EU ruminates over the precise wording of the upcoming ePrivacy Regulation that will replace the current ePrivacy Directive (Regulation), some DPAs have decided to take matters into their own hands. This year alone, several DPAs across the EU proactively revised their regulatory guidance, which to a certain extent reflects, and on other points goes even further than, the Planet49 ruling.The CJEU’s Planet49 RulingThe Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV v Planet49 GmbH (Case C-673/17) focused on a promotional lottery that Planet49 ran on its website. If users wished to enter the lottery, they would be presented with two checkboxes: (1) an unchecked box for receiving third-party advertising and (2) a pre-ticked box permitting Planet49 to set cookies to track the user’s online behavior.The CJEU decided that:<ul><li>A pre-ticked checkbox does not constitute valid cookie consent. The website operators must obtain an affirmative act from the user that demonstrates unambiguous consent.</li><li>The requirements for cookie consent are the same as the requirements for consent in the EU General Data Protection Regulation (GDPR), regardless of whether personal information is processed when placing the cookies.</li><li>Website operators are required to inform users about: (i) cookie retention periods and (ii) whether third parties are given access to the cookies.</li><li>Users must be provided with clear and comprehensive information to allow them to easily determine the consequences of providing consent. This information should be unambiguous and clearly comprehensible to the average internet user and sufficiently detailed to allow the user to understand the cookie functionalities.</li></ul>The DPAs as Supporting Characters As already mentioned above, the Planet49 ruling comes in the wake of several DPAs’ guidelines. In particular, we focus on the guidance from <a href="https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf" target="_blank" rel="noopener">the UK’s Information Commissioner’s Office</a> (ICO) and <a href="https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038783337" target="_blank" rel="noopener">France’s Commission nationale de l’informatique et des libertés</a> (CNIL). Both guidelines chime with the Planet49 ruling, even though they are not expressly referred to in the judgment. This table sets out an easy comparison of the main issues between the two DPAs:<table><tbody><tr><td width="96" style="width: undefined%; height: auto;"> </td><td width="252" style="width: undefined%; height: auto;">ICO</td><td width="276" style="width: undefined%; height: auto;">CNIL </td></tr><tr><td width="96" style="width: undefined%; height: auto;">Implied consent</td><td colspan="2" width="528" style="width: undefined%; height: auto;">Implied consent is no longer sufficient – cookies and similar technologies require a GDPR-style consent. Users must take a clear, positive action to consent to non-essential cookies. Pre-ticked boxes or continuous use of a website is not valid consent.</td></tr><tr><td width="96" style="width: undefined%; height: auto;">Cookie walls </td><td colspan="2" width="528" style="width: undefined%; height: auto;">Cookie walls that restrict access to users in order to influence users to provide consent are likely invalid. Cookie walls are not compatible with the GDPR as they do not let users exercise their choice without suffering major inconveniences in case of denial/withdrawal of consent.</td></tr><tr><td width="96" style="width: undefined%; height: auto;">Essential cookies</td><td colspan="2" width="528" style="width: undefined%; height: auto;">Consent is not required for cookies that are essential to providing the service requested by the user and cookies that are necessary for transferring information.</td></tr><tr><td width="96" style="width: undefined%; height: auto;">Analytics cookies </td><td width="252" style="width: undefined%; height: auto;">Analytics cookies are not strictly necessary and require user consent.</td><td width="276" style="width: undefined%; height: auto;">Analytics cookies do not require user consent, provided that certain conditions are met, including, but not limited to, limiting the lifespan of any analytic cookies to 13 months and that the analytics are placed by the website operator (thus only first-party analytics are allowed).</td></tr><tr><td width="96" style="width: undefined%; height: auto;">Proof of consent</td><td colspan="2" width="528" style="width: undefined%; height: auto;">Organizations using cookies must be able to demonstrate proof of the obtained consent.</td></tr><tr><td width="96" style="width: undefined%; height: auto;">Transparency obligations </td><td width="252" style="width: undefined%; height: auto;">Users must receive the same kind of information as they would when their personal information is processed, including the cookies used and the purposes for which they are used. This extends to any cookies set by third parties.</td><td width="276" style="width: undefined%; height: auto;">In addition to general information requirements (e.g., the identity of the controller(s), the purposes of cookies and how to withdraw consent), the guidelines specify that there should be an “exhaustive and regularly updated list of all entities (including third parties) using cookies.” All information must be complete, visible and highlighted at the time of the collection of consent.</td></tr></tbody></table>Against these two DPAs’ guidance, it is easy to see why the Planet49 ruling should not be treated as an outlier. In fact, a number of regulators have presented guidelines and recommendations, taking similar positions to the ICO and CNIL, such as the <a href="https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/normuitleg_ap_cookiewalls.pdf" target="_blank" rel="noopener">Dutch</a> and the <a href="https://www.dataprotection.ie/sites/default/files/uploads/2019-06/190612%20Guidance%20on%20Cookies%20and%20Similar%20Technologies.pdf" target="_blank" rel="noopener">Irish</a> DPAs. Adding fuel to the fire, the Spanish DPA (AEPD) just issued a €30,000 fine against an organization on the same basis as the Planet49 ruling: implied cookie consent, where users are not provided with the choice to opt out from the placement of cookies, is not valid. The AEPD fine is likely not the last.This is not to say that it is the same for all DPAs. Germany has never implemented the ePrivacy Directive. The German Data Protection Conference (which is the body of all German DPAs), however, did publish <a href="https://www.datenschutzkonferenz-online.de/media/oh/20190405_oh_tmg.pdf" target="_blank" rel="noopener">guidance in April 2019</a>, stating that legitimate interest could be used for some non-essential cookies, provided that the use is proportionate to the impact on the users’ privacy rights. It will be hard for a website operator to reconcile this with the ICO’s position that active consent is the only option.Other DPAs are still in the process of finalizing their guidance. Spain and Denmark, for example, have each indicated that they plan to issue revised guidance in the near future. It is currently unclear what this guidance will bring, although it is expected that the DPAs will likely not stray far from the above-mentioned approach of their EU counterparts.All in all, there appears to be no overall harmonization in sight on this topic, so multinational organizations will have a hard time coming up with a practical and cost-efficient approach to compliance.Takeaways for OrganizationsThe recent developments show that website operators should at least consider the following steps:<ul><li>Reassess your cookie consent mechanism/tool to check that there are no pre-ticked or pre-selected consent boxes or sliders. The user must be able to actively turn on/toggle any consent boxes/sliders, otherwise they are not considered to be providing valid consent.</li><li>Include both “accept” and “decline” buttons on your cookie banner, giving the user a clear choice. EU institutions (like the European Parliament and Commission) have all set up their banners in this way. Note that if a user clicks an “x” button to make the banner disappear, this does not mean that they are giving their consent.</li><li>Review your cookies and similar technologies notice to determine whether: (i) it adequately covers the information specified in the Planet49 ruling (i.e., retention periods and third-party recipients) and (ii) it is written in a clear, concise and user-friendly manner that would be understood by an average internet user (and not just your privacy lawyer and IT team who drafted it).</li></ul>As shown above, the DPAs do not appear to agree which cookies should be made exempt from the consent requirement. Again, this has led to different rules per EU Member States, a scenario that the Regulation will ideally resolve. Until then, some consideration will be needed as to whether you want to apply a pan-European approach, which satisfies the strictest DPA, or a more nuanced approach.The Never-Ending StoryWe cannot ignore the ongoing narrative of the Regulation, which has seen some movement recently after a period of inertia. According to the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_13080_2019_INIT&from=EN" target="_blank" rel="noopener">latest draft of the Regulation</a> (as of October 2019), the use of these technologies requires GDPR-standard consent. There are, however, exceptions for technologies that track audience measuring (when carried out by third-party processors), as well as security, fraud prevention, and technical fault detection. These exceptions appear to take a business-friendly approach and in parts are not as restrictive as the ICO’s position on the same. In particular, the ICO guidance explicitly defines audience measurement cookies as analytics cookies. (As mentioned above, the ICO requires consent to be obtained for analytics cookies.)The European Council plans on finalizing the draft by December 2019 and entering into discussions with the European Parliament in January 2020.It is becoming obvious that cookies will be an area of increased regulatory scrutiny over the next few months and beyond. For certain industries, such as analytics and advertising, the Planet49 ruling and the surrounding DPA guidance will at best stymie future product development and marketing efforts. As a matter of simple psychology, asking users for explicit consent will lead to significantly lower cookies acceptance rates. An average user is more likely to turn off the cookie banner for good, without clicking on the accept button or changing the cookie settings. Organizations have reported to us that implementing the ICO’s consent approach for all analytics cookies has practically obliterated their analytics metrics. Consequently, requiring a GDPR-standard consent for analytics that are not privacy-intrusive and that may not even involve personal information seems like a step too far.The Planet49 ruling and the DPAs guidance may have already stolen a march on the upcoming Regulation regarding what constitutes valid consent. However, the GDPR and the Regulation were never meant to stand in the way of organizations doing their business or frustrate whole industries. The EU still has the chance to take a more practical and business-friendly approach that does not compromise individuals’ privacy rights. Organizations can therefore only hope that the final version of the Regulation will exempt cookies that are not privacy-intrusive from the consent requirement, harmonizing the conflict in opinion between various DPAs. When it comes down to cookies and similar technologies, this appears to be the most pressing outstanding issue for the Regulation to resolve.This is therefore not a happy-ending story (yet), and the plot thickens.

Cookies: A Coming-of-Age Story