21%

The term “cookie banner” refers to a banner, or splash page, deployed on a website to inform visitors that the website uses cookies.  There is little standardization concerning how cookie banners are deployed.  Different websites position them in different places on the screen (e.g., top bar, bottom bar, or centered splash page), utilize different language to describe what cookies are, and use different terms to describe the options available to visitors.  Generally, however, most cookie banners fall within three categories:

1. Notice Only. A “notice only” cookie banner discloses to visitors that the website deploys cookies, but does not give the website visitor any direct control concerning the use of cookies.  In other words, the website visitor is not asked to permit / accept cookies, nor are they given a tool or mechanism for disabling cookies.  Some notice-only cookie banners may, however, provide information to visitors on how cookies can be disabled within the visitor’s website browser.
2. Notice + Opt Out Consent. A “notice + opt out” cookie banner discloses to visitors that the website deploys cookies and provides the visitor with a mechanism for disabling the use of cookies on the website in the future.  This may include a single option to “opt-out” of all cookies, or might provide a more granular option to opt-out of some types of cookies (e.g., behavioral advertising cookies) but no option with regard to other cookies (e.g., cookies necessary for the website to function).
3. Notice + Opt In Consent. A “notice + opt in consent” cookie banner discloses to consumers that the website would like deploy cookies and asks the visitor to opt-in to the use of cookies before the cookies are deployed.  This may include a single option to “opt in” to all cookies wherein no cookies will be placed on the browser absent consent, or it might provide a more granular option to opt-in to some types of cookies (e.g., behavioral advertising cookies), but no option with regard to other cookies (e.g., cookies necessary for the website to function).

European supervisory authorities have increasingly taken the position that websites should adopt a cookie banner with a notice and opt-in consent structure as part of their strategy for complying with the EU Privacy Directive and the GDPR.  United States companies, however, have been mixed in their desire to deploy cookie banners and, specifically, opt-in consent structured cookie banners.  The decision to deploy a cookie banner is complex and involves a number of factors, including the extent to which a company does business in Europe or is otherwise subject to the GDPR, and the extent to which a company utilizes adtech or analytics cookies on its website.  Statistically, however, 21% of the Fortune 500 currently deploy a cookie banner that purports to solicit opt-in consent to website visitors from Europe.¹

For more information and resources about the CCPA visit http://www.CCPA-info.com.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. Websites of each company in the Fortune 500 were reviewed during May and June of 2020 from an IP address associated with Ireland, using Chrome for iOS.  In situations in which a Fortune 500 company is a holding company that does not operate a significant website, the website of one of the holding company’s operating units was examined.

[View source.]