Information on cookies.

Cookies are small text files that the websites visited by users send to their devices, where they are stored and then sent back to the same websites on the next visit. So-called “third-party” cookies, by contrast, are set by a website other than the one the user is visiting. This is because each website may contain elements (images, maps, sounds, specific links to web pages on other domains, etc.) that reside on servers other than that of the website being visited.

Cookies are used for different purposes: performing computer authentication, monitoring sessions, storing information on specific configurations concerning users who access the server, storing preferences, etc.

These are cookies that are used to carry out navigation or to provide a service requested by the user. They are not used for any further purposes and are normally installed directly by the website owner.

Without these cookies, some operations could not be carried out or would be more complex and/or less secure, such as home banking activities (viewing account statements, bank transfers, bill payments, etc.), for which cookies, which make it possible to establish and maintain the user’s identification during the session, are indispensable.

No. In its decision of 8 May 2014, the Garante (Italian Data Protection Authority) specified that they may be treated as technical cookies only if they are used for site optimisation purposes directly by the website owner, who may collect information in aggregate form on the number of users and on how they visit the website. Under these conditions, the same rules on information and consent that apply to technical cookies also apply to analytics cookies.

These are cookies used to track the user’s browsing activity online and to create profiles of their tastes, habits, choices, etc. Through these cookies, advertising messages in line with the preferences already expressed by the user while browsing online may be sent to the user’s device.

It depends on the purposes for which the cookies are used and, therefore, on whether they are “technical” or “profiling” cookies.

The installation of technical cookies does not require the users’ consent, although information must be provided (Art. 13 of the Italian Privacy Code). Profiling cookies, by contrast, may be installed on the user’s device only if the user has given their consent after being informed in a simplified manner.

As established by the Garante in the decision referred to in question no. 4, information must be provided on two levels.

As soon as the user accesses a website (on the home page or on any other page), a banner must immediately appear containing a first, “short” information notice, a request for consent to the use of cookies and a link to a more “extended” information notice. On this page, the user will be able to find more detailed information on cookies and choose which specific cookies to authorise.

The banner must be large enough to partially cover the content of the web page the user is visiting. It must be possible to remove it only through an active intervention by the user, namely by selecting an element contained in the underlying page.

The banner must specify that the website uses profiling cookies, possibly including “third-party” cookies, which make it possible to send advertising messages in line with the user’s preferences.

It must contain the link to the extended information notice and state that, through that link, it is possible to refuse consent to the installation of any cookie.

It must specify that if the user chooses to continue by “skipping” the banner, they consent to the use of cookies.

To keep track of the consent obtained, the website owner may rely on a specific technical cookie, a system that is not particularly invasive and does not in turn require further consent.

Where such “documentation” exists, the short information notice need not be shown again on the user’s second visit to the website, without prejudice to the user’s ability to refuse consent and/or change their options at any time and easily, for example by accessing the extended information notice, which must therefore be accessible via a link from every page of the website.

No. Website owners always have the option of using methods other than the one identified by the Garante in the above-mentioned decision, provided that the chosen methods meet all the validity requirements for consent established by law.

No. In this case, the website owner may provide information to users in the manner they consider most appropriate, for example by including the relevant information in the privacy policy published on the website.

It must contain all the elements required by law, describe in detail the characteristics and purposes of the cookies installed by the website and allow the user to select/deselect individual cookies.

It must include the up-to-date link to the information notices and consent forms of the third parties with which the owner has entered into agreements for the installation of cookies through their website.

Finally, it must refer to the possibility for users to express their cookie preferences also through the settings of the browser they use.

The owner of the website that installs profiling cookies.

For third-party cookies installed through the website, the information and consent obligations lie with the third parties, but the website owner, as a technical intermediary between them and the users, is required to include in the “extended” information notice the up-to-date links to the information notices and consent forms of those third parties.

Profiling cookies, which usually remain on the device over time, are subject to the notification obligation, whereas cookies with other purposes that fall within the category of technical cookies do not need to be notified to the Garante.

The Garante established a one-year transitional period starting from the publication of the decision in the Official Gazette to allow the parties concerned to comply. This period will end on 2 June 2015.