L’associazione NOYB ha lanciato una nuova serie di reclami ad agosto 2022, contro un gruppo di proprietari di siti web. Questi avrebbero ignorato o non soddisfatto pienamente le richieste di aggiornare i loro cookie banner per adeguarsi agli standard del consenso UE.
In this article, we will look into Noyb’s complaints and how you can ensure that your business doesn’t fall under their radar. So keep reading for more information on Noyb, its complaints, and whether it applies to you, or jump straight to the Noyb compliance checklist to find out how you can avoid fines now and in the future.
UPDATE The European Data Protection Board (EDPB) adopted three dispute resolution decisions based on Article 65 GDPR concerning Meta Platforms Ireland Limited after NOYB filed three complaints against Facebook, Instagram, and Whatsapp 4.5 years ago. Read about this story here →
Cos’è NOYB?
I reclami di NOYB contro i cookie banner: i retroscena
Maggio 2021: NOYB, associazione europea per la difesa della privacy, lancia una campagna contro i trasgressori delle leggi sulla privacy, presentando più di 10.000 reclami. In più, come parte di quest’operazione, ai trasgressori sono stati dati dei consigli pratici per adeguarsi.
Appena un anno dopo aver dato il via a uno sforzo significativo rivolto contro tutti quei siti che infrangevano apertamente le restrizioni sul tracciamento in UE, NOYB comunica che un’altra ondata di 226 reclami è stata presentata a diciotto Autorità per la protezione dei dati (APD) in tutta l’Unione.
Questa volta ci si è concentrati sulle impostazioni ingannevoli dei cookie banner. In più, ci sono casi in cui gli utenti non possono nemmeno opporsi al tracciamento, che è un’aperta violazione della legge che governa il consenso.
noyb has set up a system to discover different types of violations and generate GDPR complaints. After a review from their legal team, companies that are found to be non-compliant are served with an informal draft complaint via email. They are given 60 days to comply with the law by changing their settings. If companies fail to do so, *noyb will file a complaint with the relevant data protection authority*. This could result in a fine of up to € 20 Million, in accordance with the GDPR.
The results of noyb’s research (https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners) found that 81 % did not offer a “reject” option on the first cookie banner layer, while a further 73% used deceptive colors and contrasts to lead users to click the “accept” option. Finally, 90% did not provide a way to withdraw consent as easily as giving it.
In 2021, more than 500 draft complaints were sent to European companies allegedly using non-compliant cookie banners. Recently, noyb has launched the second round of its action against deceptive cookie banners and dark patterns. They will continue following their goal by scanning, reviewing, warning, and enforcing the law/best practice on up to 10,000 websites in the following months.
Noyb’s compliance campaign entails sending initial complaints to the offending sites in question, offering help to rectify any dark patterns (or other consent issues). The chairman of Noyb Max Schrems has said in a statement,
We want to ensure compliance, ideally without filing cases. If a company, however continues to violate the law, we are ready to enforce users’ rights.
It’s worth mentioning that only sites that consistently disregarded these reminders and detailed compliance instructions are now the focus of official complaints with the action of the appropriate data protection authority.
I reclami di NOYB contro i cookie banner: checklist di conformità
Stando a NOYB, la “maggior parte” dei siti web a cui è stato inviato un reclamo formale, al momento non fornisce agli utenti un modo per revocare il consenso al tracciamento. Se il 30% dei siti a cui è stato inviato un reclamo ha aggiunto un pulsante per rifiutare gli annunci pubblicitari, altri continuano a ignorare aspetti importanti come design ingannevoli. Schrems ha aggiunto:
Instead of giving a simple yes or no option, companies use every trick in the book to manipulate users. We have identified more than fifteen common abuses. The most common issue is that there is simply no ‘reject’ button on the initial page.
In merito ai reclami di NOYB, abbiamo messo insieme una semplice checklist da seguire per il tuo cookie banner:
👉 Give users a way to withdraw consent – Make sure you enable the privacy widget in your Privacy Controls and Cookie Solution.
👉 Provide unambiguous designs – Designing an unambiguous banner is straightforward. Simply edit your compliant cookie banner in your dashboard.
👉 Provide a reject button on users’ first visit to your site.
👉 Do not pre-tick options on your cookie banner. Make sure you select all compliance settings to configure a compliant cookie banner automatically.
👉 Do not provide a link instead of a button.
Rispettare la legge non deve essere complicato. Per aiutarti a rendere il tuo sito web conforme, iubenda offre soluzioni software a prova di avvocato. Prepara la tua azienda per il futuro, senza stress.
iubenda e l’importanza della protezione dei dati online
The noyb campaign has become very popular within the internet and online news communities, but in fact, they are highlighting points that data protection authorities have already been adopting across Europe in order to prevent dark patterns and ensure clear and more informed choices.
Negli anni, iubenda si è impegnata a offrire soluzioni semplici ed efficaci per adeguarsi alle normative sulla protezione dei dati, con un’attenzione particolare alle migliori prassi internazionali. Inoltre, ha cercato di sensibilizzare le aziende sull’importanza di questi argomenti.
How to meet NOYB’s requirements with the Privacy Controls and Cookie Solution
Our Privacy Controls and Cookie Solution helps you fully comply with the requirements of the GDPR ePrivacy and more. Not only does it give you full customization control over your cookie banner and settings, but the automated default GDPR configuration puts you ahead of the game by preventing the major points of non-conformity considered by noyb’s analysis. And, of course, it allows you to be compliant with the rules imposed by the GDPR itself and national DPAs.
Scendendo ancora di più nel dettaglio, diamo un’occhiata a come impostare correttamente il tuo cookie banner partendo dalle “violazioni tipo” di NOYB.
Within the Privacy Controls and Cookie Solution configurator, click on EDIT under the GDPR configuration and select Manual configuration, then make sure that the “Explicit Reject button“ option is enabled.
Our solution is designed to always respect the opt-in principle, just make sure to have the “Offer granular control with per-category consent” option enabled
Our default configuration ensures that the accept and reject buttons are equally conspicuous (color/design/prominence) but you can customize them inside the Style & Text configuration, under Theme options (click on EDIT).
Note that these buttons’ “equal prominence” is a mandatory requirement in several countries, so we highly suggest using the same graphic configuration for both buttons.
Our solution does not allow the use of a link or other options that may make customization hidden or hard to find
The customize button is linked to the accept button, and it’s present by default (you can still manage the enabling of these buttons under the GDPR Manual configuration though).
In terms of design and colors, the customize button does not need to be exactly the same as the accept and reject buttons, in any case you can customize it inside the Style & Text configuration, under Theme options (click on EDIT).
Just check that the button is clearly visible and not hidden by other graphic configurations (e.g. background color and text).
This might be relevant only if you have enabled the IAB TCF configuration. In this case, you should restrict purposes to only allow Consent as a valid legal basis to treat data.
Under the IAB TCF configuration (click on EDIT), enable Restrict purposes and select the “Consent only“ option on each enabled purpose
Please note that also some national DPAs, like in Italy and Belgium, have excluded the use of legitimate interest as a valid legal basis, that’s why it’s important to restrict it to “Consent only” if you operate in those countries (you can read more about country-specific requirements in our Cookie Consent Cheatsheet).
Our cookie management solution can recognize and block a wide range of cookies, with the exception of the so-called strictly necessary cookies. You can still manually identify the scripts that are subjected to the requirement of prior consent.
Keep attention to set prior blocking to all non-essential cookies. You might have to modify the category you assigned to some script that installs cookies for this issue. You can read more about Manual tagging in this guide.
By default, our solution integrates a privacy widget that allows users to easily access and edit their privacy preferences.
Within Privacy Widget options (under Style & Text configurations) you can customize the position, format, and colors of your widget or choose to add a link in the footer to your page to access privacy and tracking preferences.
I passaggi che abbiamo appena indicato possono essere utili sia per evitare un reclamo da parte di NOYB, oppure per verificare semplicemente che le tue impostazioni siano in linea con i requisiti del GDPR.