In the Czech Republic, this is problematic particularly where consent is needed for the related processing of personal data, for instance if the data collected by cookies and tracking are used for personalized advertising.
According to the European Data Protection Board’s updated statement No. 5/2020 on Consent, consent like this is not given freely, for the user is not given an actual option to not consent. Personal data processing that is based on this consent thus contravenes the GDPR. Therefore, cookie walls are not advisable even in the Czech Republic.
Deriving consent from the user’s behavior
Thus, consent cannot be obtained indirectly based merely on the fact that users browse a page, spend a particular amount of time on the page, or that they have scrolled down half of the page. Such user interaction with a page does not directly imply users’ intention to give consent, as users might have some other motives (e.g. they might be trying to find contact details, which are usually located at the bottom of a webpage).
Classifying cookies as essential even if they are not
There are certain types of cookies that do not need the user’s consent for their use, and even Czech legislation does not set out an obligation to provide an option to refuse them. These are so-called essential cookies that serve the purpose of technical storage, or exclusively for the transmission of communications, or they are essential for information companies to provide the online service which the user has explicitly requested.
This no-go zone is relevant for the Czech Republic when the operator of a website incorrectly classifies cookies in such a way that an opt-out option is denied, does not provide information about personal data processing, or does not obtain consent to personal data processing (if it is needed).
But neither opt-in nor opt-out apply to essential cookies. Therefore, website operators could be tempted to include in this category as many cookies as possible. As the Irish inspection office has found, in practice non-essential cookies are sometimes also included in this category. This is mainly because the classification of cookies is subject purely to the website operator’s discretion.
Cookies that are used for improving users’ experience, for instance those that remember search histories, are among those that are often mistakenly categorized as essential. We also cannot classify as essential cookies that are used for chatbots – such cookies become essential only after the user starts using a chatbot actively, which according to law, means that the user explicitly requests the service. On the contrary, cookies that are needed in particular for adding goods to a cart and for placing an order are genuinely essential.
By Michal Nulicek, Partner, Bohuslav Lichnovsky, Senior Associate, and Filip Benes, Junior Lawyer, Rowan Legal