A organização NOYB lançou uma nova rodada de reclamações sobre cookies em agosto de 2022, contra um grupo seleto de proprietários de sites que alega desconsiderar ou não reconhecer totalmente as solicitações anteriores para atualizar os seus consentimentos de banner de cookies para cumprir os padrões legais de consentimento da UE.
In this article, we will look into Noyb’s complaints and how you can ensure that your business doesn’t fall under their radar. So keep reading for more information on Noyb, its complaints, and whether it applies to you, or jump straight to the Noyb compliance checklist to find out how you can avoid fines now and in the future.
UPDATE The European Data Protection Board (EDPB) adopted three dispute resolution decisions based on Article 65 GDPR concerning Meta Platforms Ireland Limited after NOYB filed three complaints against Facebook, Instagram, and Whatsapp 4.5 years ago. Read about this story here →
O que é a NOYB?
NOYB Reclamações de Cookies – O histórico
Maio de 2021 A organização europeia de privacidade noyb lançou uma campanha massiva para apagar o fogo da não conformidade, trazendo até 10.000 reclamações contra infratores. Além disso, como parte desta operação, os infratores receberam aconselhamento gratuito para ajudá-los a cumprir.
Pouco mais de um ano após iniciar um esforço significativo visando milhares de sites que violam descaradamente as restrições de rastreamento de cookies da UE, Noyb relata que o lote mais recente de 226 reclamações foi apresentado a 18 autoridades de proteção de dados (APDs) em toda a UE.
As preocupações se concentram em configurações enganosas descobertas nas configurações dos banners de cookies. Além disso, os usuários do site podem nem mesmo ser autorizados a recusar o rastreamento, o que seria uma violação flagrante da legislação que rege o consentimento.
noyb has set up a system to discover different types of violations and generate GDPR complaints. After a review from their legal team, companies that are found to be non-compliant are served with an informal draft complaint via email. They are given 60 days to comply with the law by changing their settings. If companies fail to do so, *noyb will file a complaint with the relevant data protection authority*. This could result in a fine of up to € 20 Million, in accordance with the GDPR.
The results of noyb’s research (https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners) found that 81 % did not offer a “reject” option on the first cookie banner layer, while a further 73% used deceptive colors and contrasts to lead users to click the “accept” option. Finally, 90% did not provide a way to withdraw consent as easily as giving it.
In 2021, more than 500 draft complaints were sent to European companies allegedly using non-compliant cookie banners. Recently, noyb has launched the second round of its action against deceptive cookie banners and dark patterns. They will continue following their goal by scanning, reviewing, warning, and enforcing the law/best practice on up to 10,000 websites in the following months.
Noyb’s compliance campaign entails sending initial complaints to the offending sites in question, offering help to rectify any dark patterns (or other consent issues). The chairman of Noyb Max Schrems has said in a statement,
We want to ensure compliance, ideally without filing cases. If a company, however continues to violate the law, we are ready to enforce users’ rights.
It’s worth mentioning that only sites that consistently disregarded these reminders and detailed compliance instructions are now the focus of official complaints with the action of the appropriate data protection authority.
NOYB Reclamações de cookies – Lista de verificação de conformidade
De acordo com Noyb, “a maioria” dos sites sobre os quais apresentou queixas formais atualmente não oferece aos usuários uma maneira de retirar o seu consentimento para rastreamento. Embora 30% de todos os sites avisados tenham implementado um botão de recusar de anúncios em seus sites, outros ainda ignoram aspectos como designs enganosos. Schrems disse:
Instead of giving a simple yes or no option, companies use every trick in the book to manipulate users. We have identified more than fifteen common abuses. The most common issue is that there is simply no ‘reject’ button on the initial page.
Em relação às reclamações feitas pela Noyb, compilamos uma lista de verificação simples e fácil de fazer para o seu banner de cookies:
👉 Give users a way to withdraw consent – Make sure you enable the privacy widget in your Privacy Controls and Cookie Solution.
👉 Provide unambiguous designs – Designing an unambiguous banner is straightforward. Simply edit your compliant cookie banner in your dashboard.
👉 Provide a reject button on users’ first visit to your site.
👉 Do not pre-tick options on your cookie banner. Make sure you select all compliance settings to configure a compliant cookie banner automatically.
👉 Do not provide a link instead of a button.
A conformidade não precisa ser complicada. Para ajudar a tornar os sites compatíveis, a iubenda oferece soluções de software para advogados. Alivia a tensão e ajuda a garantir que a sua empresa esteja preparada para o futuro.
iubenda e a importância da conformidade com a proteção de dados online
The noyb campaign has become very popular within the internet and online news communities, but in fact, they are highlighting points that data protection authorities have already been adopting across Europe in order to prevent dark patterns and ensure clear and more informed choices.
Ao longo dos anos, a iubenda aposta em oferecer soluções simples e eficazes para o cumprimento das normas de proteção de dados, com um olhar atento às melhores práticas internacionais e estimulando a sensibilidade das empresas para estes temas.
How to meet NOYB’s requirements with the Privacy Controls and Cookie Solution
Our Privacy Controls and Cookie Solution helps you fully comply with the requirements of the GDPR ePrivacy and more. Not only does it give you full customization control over your cookie banner and settings, but the automated default GDPR configuration puts you ahead of the game by preventing the major points of non-conformity considered by noyb’s analysis. And, of course, it allows you to be compliant with the rules imposed by the GDPR itself and national DPAs.
Entrando em mais detalhes, vamos ver como ter certeza de definir as configurações corretas para seu banner de cookies, usando a lista de “tipos de violação” da noyb.
Within the Privacy Controls and Cookie Solution configurator, click on EDIT under the GDPR configuration and select Manual configuration, then make sure that the “Explicit Reject button“ option is enabled.
Our solution is designed to always respect the opt-in principle, just make sure to have the “Offer granular control with per-category consent” option enabled
Our default configuration ensures that the accept and reject buttons are equally conspicuous (color/design/prominence) but you can customize them inside the Style & Text configuration, under Theme options (click on EDIT).
Note that these buttons’ “equal prominence” is a mandatory requirement in several countries, so we highly suggest using the same graphic configuration for both buttons.
Our solution does not allow the use of a link or other options that may make customization hidden or hard to find
The customize button is linked to the accept button, and it’s present by default (you can still manage the enabling of these buttons under the GDPR Manual configuration though).
In terms of design and colors, the customize button does not need to be exactly the same as the accept and reject buttons, in any case you can customize it inside the Style & Text configuration, under Theme options (click on EDIT).
Just check that the button is clearly visible and not hidden by other graphic configurations (e.g. background color and text).
This might be relevant only if you have enabled the IAB TCF configuration. In this case, you should restrict purposes to only allow Consent as a valid legal basis to treat data.
Under the IAB TCF configuration (click on EDIT), enable Restrict purposes and select the “Consent only“ option on each enabled purpose
Please note that also some national DPAs, like in Italy and Belgium, have excluded the use of legitimate interest as a valid legal basis, that’s why it’s important to restrict it to “Consent only” if you operate in those countries (you can read more about country-specific requirements in our Cookie Consent Cheatsheet).
Our cookie management solution can recognize and block a wide range of cookies, with the exception of the so-called strictly necessary cookies. You can still manually identify the scripts that are subjected to the requirement of prior consent.
Keep attention to set prior blocking to all non-essential cookies. You might have to modify the category you assigned to some script that installs cookies for this issue. You can read more about Manual tagging in this guide.
By default, our solution integrates a privacy widget that allows users to easily access and edit their privacy preferences.
Within Privacy Widget options (under Style & Text configurations) you can customize the position, format, and colors of your widget or choose to add a link in the footer to your page to access privacy and tracking preferences.
As etapas que detalhamos acima podem ser úteis se você deseja evitar provocar uma reclamação do noyb ou apenas deseja verificar se as suas configurações são consistentes com os requisitos gerais do GDPR.