Last month Poland joined the club of EU Member States to implement Europe's consent requirement for cookies set on users' devices. Rumoured to be one of the Member States contemplating strict
Last month Poland joined the club of EU Member States to implement Europe's consent requirement for cookies set on users' devices. Rumoured to be one of the Member States contemplating strict opt-in, all eyes were watching to see how exactly it would implement the cookie consent rule.
Cookie rules
Poland's cookie consent law entered into force only on 25 March 2013 and seemingly introduced an opt-in requirement before setting cookies - with potential fines of up to 3% of revenue for website operators in breach.
Specifically, the new law imposes an obligation to inform users in advance, in a clear, unambiguous and easily understandable manner about:
1) The fact that cookies are being placed on their devices;
2) The purposes for which cookies are used;
3) The user’s right to access information about them; and
4) The ability to accept or refuse the cookie.
Like most Member States, consent is not needed for strictly necessary cookies.
So does Poland really require opt-in?
During the legislative work on the amendment various approaches to valid consent form were proposed: implied, written and even signified through a simple “I accept” button. In the end, Article 173 (2) of the amended Telecommunication Law says that:
The subscriber or end user can express consent (...) by means of settings of a software installed on the telecommunication device they are using or through settings of the service
The two main regulator’s websites in Poland have both adopted an implied cookie consent banner approach and even the Polish Ministry of Administration and Digitization (Ministerstwo Administracji i Cyfracji) has indicated it supports consent obtained through browser settings. It is unclear whether this would extend to default browser settings.
What does this mean?
For businesses still building out their cookie consent strategy for the EU, this is good news: Poland was one of a couple of 'outlier' states threatening to adopt strict opt-in consent for cookies. Had it adopted strict opt-in as the standard for consent, businesses operating on a pan-EU basis would have had to implement a different consent solution for Poland than for other, more relaxed EU territories where they could instead rely on implied consent.
In the end, this hasn't happened and the other key outlier territory, the Netherlands, also looks set to acknowledge the validity of implied consent in the very near future. When the cookie consent rule first came into effect in Europe back in 2011, nobody knew what a robust but pragmatic cookie consent solution would look like; now, two years on, both business and regulators alike are increasingly settling on implied consent as the answer.
Cookie rules
Poland's cookie consent law entered into force only on 25 March 2013 and seemingly introduced an opt-in requirement before setting cookies - with potential fines of up to 3% of revenue for website operators in breach.
Specifically, the new law imposes an obligation to inform users in advance, in a clear, unambiguous and easily understandable manner about:
1) The fact that cookies are being placed on their devices;
2) The purposes for which cookies are used;
3) The user’s right to access information about them; and
4) The ability to accept or refuse the cookie.
Like most Member States, consent is not needed for strictly necessary cookies.
So does Poland really require opt-in?
During the legislative work on the amendment various approaches to valid consent form were proposed: implied, written and even signified through a simple “I accept” button. In the end, Article 173 (2) of the amended Telecommunication Law says that:
The subscriber or end user can express consent (...) by means of settings of a software installed on the telecommunication device they are using or through settings of the service
The two main regulator’s websites in Poland have both adopted an implied cookie consent banner approach and even the Polish Ministry of Administration and Digitization (Ministerstwo Administracji i Cyfracji) has indicated it supports consent obtained through browser settings. It is unclear whether this would extend to default browser settings.
What does this mean?
For businesses still building out their cookie consent strategy for the EU, this is good news: Poland was one of a couple of 'outlier' states threatening to adopt strict opt-in consent for cookies. Had it adopted strict opt-in as the standard for consent, businesses operating on a pan-EU basis would have had to implement a different consent solution for Poland than for other, more relaxed EU territories where they could instead rely on implied consent.
In the end, this hasn't happened and the other key outlier territory, the Netherlands, also looks set to acknowledge the validity of implied consent in the very near future. When the cookie consent rule first came into effect in Europe back in 2011, nobody knew what a robust but pragmatic cookie consent solution would look like; now, two years on, both business and regulators alike are increasingly settling on implied consent as the answer.