Likely no.
The placement of analytics or behavioural advertising cookies can only be accomplished when the basis for the placement of the cookies is the data subject’s consent. In order for consent to comply with the requirements under GDPR or the ePrivacy Directive, it must be, among other things, freely given and the product an affirmative, opt-in decision by the data subject.1 This means that you cannot simply disclose use of analytics or behavioural advertising cookies and assume the user has consented by continuing to utilize the website. The ICO’s guidance on this issue states “[c]onsent must be separate from other matters and cannot be bundled into terms and conditions or privacy notices. The key point is that you should be upfront with your users about your use of cookies. You should obtain consent by giving the user specific separate information about what they are being asked to agree to and providing them with a way to accept by means of a positive action to opt-in.” 2
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. GDPR, Recital 32; see https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf (published 3 July 2019) (“If the cookies you set aren’t exempt . . . then you can only use consent – and this must be of the GDPR standard. This is also the case whether or not personal data is involved.”).
2. See https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf (published 3 July 2019).
[View source.]
