La organización NOYB lanzó una nueva ronda de reclamaciones sobre cookies en agosto de 2022 contra un grupo selecto de titulares de sitios web que, según afirma, han desatendido o no han reconocido plenamente las solicitudes previas de actualizar sus banners de cookies para cumplir con las normas legales de la UE en materia de consentimiento.
In this article, we will look into Noyb’s complaints and how you can ensure that your business doesn’t fall under their radar. So keep reading for more information on Noyb, its complaints, and whether it applies to you, or jump straight to the Noyb compliance checklist to find out how you can avoid fines now and in the future.
UPDATE The European Data Protection Board (EDPB) adopted three dispute resolution decisions based on Article 65 GDPR concerning Meta Platforms Ireland Limited after NOYB filed three complaints against Facebook, Instagram, and Whatsapp 4.5 years ago. Read about this story here →
¿Qué es NOYB?
Reclamaciones sobre cookies de NOYB: Los antecedentes
Mayo de 2021: La organización europea de defensa de la privacidad noyb lanzó una campaña masiva para acabar con el incumplimiento legal, presentando hasta 10.000 denuncias contra los infractores. Además, como parte de esta operación, los infractores recibieron asesoramiento gratuito para ayudarles a cumplir con la normativa.
Poco más de un año después de iniciar un importante esfuerzo dirigido a miles de sitios web que incumplen descaradamente las restricciones de la UE en materia de seguimiento de cookies, noyb informa de que la tanda más reciente de 226 denuncias se ha presentado ante 18 autoridades de protección de datos (APD) de toda la UE.
Las preocupaciones se centran en los ajustes engañosos descubiertos en las configuraciones de los banners de cookies. Además, es posible que ni siquiera se permita a los usuarios de los sitios web decidir que no se realice el seguimiento, lo que supondría una flagrante violación de la legislación que regula el consentimiento.
noyb has set up a system to discover different types of violations and generate GDPR complaints. After a review from their legal team, companies that are found to be non-compliant are served with an informal draft complaint via email. They are given 60 days to comply with the law by changing their settings. If companies fail to do so, *noyb will file a complaint with the relevant data protection authority*. This could result in a fine of up to € 20 Million, in accordance with the GDPR.
The results of noyb’s research (https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners) found that 81 % did not offer a “reject” option on the first cookie banner layer, while a further 73% used deceptive colors and contrasts to lead users to click the “accept” option. Finally, 90% did not provide a way to withdraw consent as easily as giving it.
In 2021, more than 500 draft complaints were sent to European companies allegedly using non-compliant cookie banners. Recently, noyb has launched the second round of its action against deceptive cookie banners and dark patterns. They will continue following their goal by scanning, reviewing, warning, and enforcing the law/best practice on up to 10,000 websites in the following months.
Noyb’s compliance campaign entails sending initial complaints to the offending sites in question, offering help to rectify any dark patterns (or other consent issues). The chairman of Noyb Max Schrems has said in a statement,
We want to ensure compliance, ideally without filing cases. If a company, however continues to violate the law, we are ready to enforce users’ rights.
It’s worth mentioning that only sites that consistently disregarded these reminders and detailed compliance instructions are now the focus of official complaints with the action of the appropriate data protection authority.
Reclamaciones sobre cookies de NOYB: Lista de verificación del cumplimiento
Según noyb, la «mayoría» de los sitios web sobre los que ha presentado reclamaciones formales no ofrecen a día de hoy a los usuarios la posibilidad de retirar su consentimiento al seguimiento. Mientras que el 30% de los sitios web advertidos han implementado un botón para rechazar los anuncios en su web, otros siguen ignorando aspectos como los diseños que pueden inducir a error. Schrems ha declarado:
Instead of giving a simple yes or no option, companies use every trick in the book to manipulate users. We have identified more than fifteen common abuses. The most common issue is that there is simply no ‘reject’ button on the initial page.
Con respecto a las reclamaciones de noyb, hemos creado una lista de verificación sencilla y fácil de seguir para tu banner de cookies:
👉 Give users a way to withdraw consent – Make sure you enable the privacy widget in your Privacy Controls and Cookie Solution.
👉 Provide unambiguous designs – Designing an unambiguous banner is straightforward. Simply edit your compliant cookie banner in your dashboard.
👉 Provide a reject button on users’ first visit to your site.
👉 Do not pre-tick options on your cookie banner. Make sure you select all compliance settings to configure a compliant cookie banner automatically.
👉 Do not provide a link instead of a button.
El cumplimiento legal no tiene por qué ser complicado. Para ayudar a los sitios web a cumplir con la normativa, iubenda ofrece soluciones de software de primer nivel. Alivia la tensión y ayuda a garantizar que tu negocio esté preparado para el futuro.
iubenda y la importancia de cumplir con la protección de datos online
The noyb campaign has become very popular within the internet and online news communities, but in fact, they are highlighting points that data protection authorities have already been adopting across Europe in order to prevent dark patterns and ensure clear and more informed choices.
A lo largo de los años, iubenda ha apostado por ofrecer soluciones sencillas y eficaces para el cumplimiento de la normativa de protección de datos, con una mirada atenta a las mejores prácticas internacionales y estimulando la sensibilidad de las empresas hacia estos temas.
How to meet NOYB’s requirements with the Privacy Controls and Cookie Solution
Our Privacy Controls and Cookie Solution helps you fully comply with the requirements of the GDPR ePrivacy and more. Not only does it give you full customization control over your cookie banner and settings, but the automated default GDPR configuration puts you ahead of the game by preventing the major points of non-conformity considered by noyb’s analysis. And, of course, it allows you to be compliant with the rules imposed by the GDPR itself and national DPAs.
Entrando más en detalle, vamos a ver cómo podemos asegurarnos de establecer la configuración correcta para tu banner de cookies, utilizando la lista de «tipos de infracción» de noyb.
Within the Privacy Controls and Cookie Solution configurator, click on EDIT under the GDPR configuration and select Manual configuration, then make sure that the “Explicit Reject button“ option is enabled.
Our solution is designed to always respect the opt-in principle, just make sure to have the “Offer granular control with per-category consent” option enabled
Our default configuration ensures that the accept and reject buttons are equally conspicuous (color/design/prominence) but you can customize them inside the Style & Text configuration, under Theme options (click on EDIT).
Note that these buttons’ “equal prominence” is a mandatory requirement in several countries, so we highly suggest using the same graphic configuration for both buttons.
Our solution does not allow the use of a link or other options that may make customization hidden or hard to find
The customize button is linked to the accept button, and it’s present by default (you can still manage the enabling of these buttons under the GDPR Manual configuration though).
In terms of design and colors, the customize button does not need to be exactly the same as the accept and reject buttons, in any case you can customize it inside the Style & Text configuration, under Theme options (click on EDIT).
Just check that the button is clearly visible and not hidden by other graphic configurations (e.g. background color and text).
This might be relevant only if you have enabled the IAB TCF configuration. In this case, you should restrict purposes to only allow Consent as a valid legal basis to treat data.
Under the IAB TCF configuration (click on EDIT), enable Restrict purposes and select the “Consent only“ option on each enabled purpose
Please note that also some national DPAs, like in Italy and Belgium, have excluded the use of legitimate interest as a valid legal basis, that’s why it’s important to restrict it to “Consent only” if you operate in those countries (you can read more about country-specific requirements in our Cookie Consent Cheatsheet).
Our cookie management solution can recognize and block a wide range of cookies, with the exception of the so-called strictly necessary cookies. You can still manually identify the scripts that are subjected to the requirement of prior consent.
Keep attention to set prior blocking to all non-essential cookies. You might have to modify the category you assigned to some script that installs cookies for this issue. You can read more about Manual tagging in this guide.
By default, our solution integrates a privacy widget that allows users to easily access and edit their privacy preferences.
Within Privacy Widget options (under Style & Text configurations) you can customize the position, format, and colors of your widget or choose to add a link in the footer to your page to access privacy and tracking preferences.
Los pasos que hemos detallado anteriormente pueden ser útiles tanto si quieres evitar una reclamación de noyb como si simplemente quieres verificar que tu configuración es coherente con los requisitos generales del RGPD.