The term “cookie notice” or “cookie banner” refers to a banner, splash page, or other notice that deploys on a website to inform visitors that the site uses cookies.  While cookie banners are fairly ubiquitous in the European Union, owing to both the General Data Protection Regulation and the ePrivacy Directive, historically they have been less common in the United States.  As companies consider strategies for complying with the CCPA’s notice, sharing, service provider, and sale provisions, attention is focused on whether businesses in the United States will begin to use cookie notices as a compliance or risk mitigation tool.

There are multiple ways in which cookie notices can be configured.  Typically, a cookie notice will fall into one of three formats:

1. Notice Only.  A “notice only” disclosure informs visitors that the website deploys cookies, but does not give the website visitor any direct control concerning the use of cookies.  In other words, the website visitor is not asked to permit / accept cookies, nor are they given a tool or mechanism for disabling cookies.  Some notice-only cookie banners may, however, provide information to the visitor on how cookies can be disabled within the visitor’s website browser.
2. Notice + Opt Out. A “notice + opt out” disclosure informs visitors that the website deploys cookies and provides the visitor with a mechanism for disabling the website’s future deployment of cookies.  This may include a single option to “opt-out” of all cookies, or might provide more granular options to opt-out of some types of cookies (e.g., behavioral advertising cookies or analytic cookies).
3. Notice + Opt In Consent.  A “notice + opt in consent” disclosure informs visitors that the website would like to deploy cookies and asks the visitor to opt-in, or accept, cookies before they are deployed.  This may include a single option to “opt in” to all cookies, or it might provide a more granular option to opt-in to some types of cookies (e.g., behavioral advertising cookies).  It is worth noting that some companies have been criticized for providing “notice + opt-in” disclosures, but then ignoring whether the website visitor provides opt-in consent.  In other words, deploying cookies regardless of whether consent is obtained.

In order to help companies understand and benchmark industry practice, BCLP analyzed a random sample of the homepages of the Fortune 500 to better understand their use of cookie notices and cookie banners.¹  As of December 14, 2019, only 28% of companies were deploying some form of cookie notice.²  As the following chart illustrates, among the companies that were deploying notices there was little standardization in terms of whether notice, opt-out, or opt-in disclosures were utilized: 

For more information and resources about the CCPA visit http://www.CCPA-info.com. 

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. Using a computer random number generator, BCLP selected 10% of the companies listed among the Fortune 500 in 2019.  Revenues for the selected companies ranged from $85 billion to $5 billion.  While BCLP did not conduct statistical analysis to determine whether the sample selected accurately represented the range of businesses in the United States, the sample contained companies focused on retail, financials, food, agriculture, manufacturing, entertainment, and energy.  BCLP/601337099.

2. Note that some companies in the survey population maintain multiple homepages.  For example, a corporation might own several different retail brands.  The survey focused only on the homepage of the corporate parent (if available) and did not analyze brand-specific practices.  If no corporate homepage was available the survey reviewed the website of the company’s most prevalent brand.

[View source.]