You can also use them to get users to consent to place cookies on their devices.
Read on to learn more about cookie notification messages, when you need them, and how to create yours. If you’re not quite sure what any of this means, make sure to read our in-depth cookie guide for more information on cookies in general.
What Is a Cookie Notification Message?
These messages are required by certain privacy and cookie laws, such as the European Union’s General Data Protection Regulation (GDPR).
Why Do You Need a Cookie Message?
There are many reasons you need a cookie message on your website.
Whether you’re in the US, the EU, or another country or area, you need to put cookie messages on your site if you’re marketing to people who live in countries or regions with strict cookie laws.
For example, you need to comply with the EU’s GDPR if you target consumers from the European Economic Area (EEA), even if your company and website server are US-based. The GDPR applies to any website that offers services or products to EU citizens or collects personal information from EU citizens.
In the US
Although there are no cookie laws in the US, some states have laws that regulate cookie usage for their residents, such as the California Consumer Privacy Act (CCPA).
The California Consumer Privacy Act (CCPA)
The CCPA protects Californian users’ data from privacy violations. Like the GDPR, it regulates the use of personal information, including cookies.
In contrast with the GDPR, the CCPA doesn’t require an organization to obtain user consent for collecting and processing their personal information. However, the organization must give users the right to opt out of the sale of personal information if it collects and sells users’ personal information to third parties.
Consent is also required for specific circumstances like collecting and using the personal information of minors under 16 and information transfer.
The Children’s Online Privacy Protection Act (COPPA)
Like the CCPA, COPPA protects minors’ right to privacy. It applies to all websites and online businesses that collect, use, or disclose personal information from children and requires you to give direct notices to parents about cookie collection.
- Contact information (e.g., name, telephone number, address, and email address) of all the operators that maintain or collect personal information through your site or service.
- Description of the information that the operator collects from children, which should include whether the operator enables children to make their personal information available to the public, the operator’s disclosed practices for this information, and how the operation will use such information.
- How parents can review or request to delete their children’s personal information. You should also outline how parents can limit the further collection or use of their children’s data.
In the EU
Cookie messages are required by law by the EU’s General Data Protection Regulation (GDPR) and ePrivacy Directive.
The EU’s GDPR is the world’s strictest cookie law. It came into effect on May 15, 2018, and applies to all websites targeting EEA consumers.
Although the word “cookie” is only mentioned once in its 88 pages, the GDPR is a game-changer for cookie usage. Unlike previous privacy mandates, such as the ePrivacy Directive, the GDPR makes it mandatory for websites to get consent from users before putting cookies on their browsers.
For consent to be valid, it must be:
- Specific and unambiguous
- Freely given, which means it must be given voluntarily
- Informed, which means the site must inform the user about cookies before placing them on their browser
- Expressed through explicit, affirmative action
This requirement for active consent expressed through clear, affirmative action stands in stark contrast to the EU Cookies Law or ePrivacy Directive of 2002, which allowed passive or implied consent.
Since the user cannot opt out or consent to cookies before the cookies get placed on their browser, the user cannot give valid consent under the GDPR. As such, cookie messages with passive consent do not comply with the GDPR.
The ePrivacy Regulation is a revised version of the current ePrivacy Directive — also commonly referred to as the Cookie Law. Like the GDPR, the Regulation operates in the EU but requires compliance from any website or organization targeting EU users.
It’s intended to work with the GDPR to establish the EU’s reformed data protection framework, but it still hasn’t come into effect. When finalized, the ePrivacy Regulation will expand on the GDPR and establish more straightforward rules for cookies.
We don’t know what all these rules will be like yet, but the European Commission has stated that no consent will be needed for cookies that don’t intrude on privacy. These include cookies that improve user experience, such as those used to remember shopping cart history.
Rest of the World
There are also some other countries with similar legislation.
Unlike California and the EU, Canada doesn’t have legislation specifically regulating cookies. However, cookie regulation is part of Canada’s anti-spam and privacy laws.
According to Canada’s federal Anti-Spam Law (“CASL”), it’s illegal to install any program or software on another person’s computer during commercial activity without first obtaining their express consent.
Like the GDPR, the CASL requires user consent to be obtained in a particular way. A person — defined as any corporation, organization, individual, partnership, trustee, receiver, association, or legal representative — must explicitly state the following before obtaining express consent:
- Why you are seeking the person’s consent
- The identity of the person seeking the consent
However, the CASL also says that a person is deemed to have given express consent to cookie installation if it’s reasonable to believe that the person has consented through their conduct. Unfortunately, there’s currently not much guidance on what kind of conduct is deemed “reasonable” — the only example provided by the CASL’s regulator is that a person will not be considered to have consented if they have disabled cookies through their browser.
Canadian privacy law (PIPEDA) generally requires consent to collect, use, and disclose personal information. The safest way to obtain this consent is through express, informed consent, such as cookie notifications.
All in all, this suggests that Canada’s cookie regulation is much less strict than what we see in California and the EU.
Singapore’s data protection act, the Personal Data Protection Act (PDPA), regulates the handling of personal data and marketing. It establishes how organizations use, collect, and dispose of Singaporeans’ personal data.
Like the GDPR, the PDPA stipulates that you must have user consent before collecting or using their personal data. Therefore, you must include the following details when obtaining user consent:
- Reason for handling the users’ personal data.
- Any other purpose you have for handling the users’ data that you hadn’t disclosed before.
- Upon the users’ request, you must provide the contact information of a person who acts on behalf of the organization requesting the users’ data. This person will have to answer the users’ questions about collecting, using, or disclosing their data.
However, unlike the GDPR, the PDPA accepts implied or deemed consent under certain circumstances. These include:
- Deemed consent: consent can be implied or deemed to be given if using, collecting, or disclosing users’ personal data is required to fulfill a contract between the organization and the user.
- Deemed consent by notification: companies can deem consent if they provide notification of the purpose behind the collection, use, or disclosure of personal data. At the same time, they must also give the users a reasonable period to opt out. Consent will be deemed given if the users don’t opt out within this period.
Singapore’s PDPA is more similar to Canada’s CASL than it is to the GDPR since it accepts implied or deemed consent.
What Needs to Be in a Cookie Message?
Your cookie message needs to do the following to comply with the GDPR:
- List the types of cookies that are present on the website (e.g., essential, functional, marketing)
For example, The Guardian’s cookie message below does all three of these things.
The Guardian’s banner:
Where Do You Need to Display a Cookie Notification?
To ensure compliance, you need to place a cookie notification message on every page of your website.
How to Create a Cookie Message
Creating cookie notification pop-ups from scratch can be difficult, especially if you don’t have the time and energy to ensure your messages comply with the relevant legislation.
Here are some ways you can kickstart your creation of a cookie notification message.
Managed Solution (Recommended)
The most time-saving and secure way to ensure you are compliant with cookie requirements is to get a managed solution like Termly’s Cookie Consent Manager.
Powerful yet easy to use, our Cookie Consent Manager is a browser-based tool that requires minimal effort on your part.
Use Termly to Create a Cookie Notification
- Step 1: Enter your website URL into Termly’s scanner
- Step 2: We will scan your site and categorize the majority of your cookies
If you’re the owner of a WordPress site, consider downloading a cookie message plugin. These tools will give you customizable cookie messages and pop-ups that will help you comply with cookie requirements.
Unlike DIY or templates, plugins already come with coding, colors, WordPress page synchronization, and formatting, so all you have to do is change the text and look to fit your brand.
DIY Solution (Not Recommended)
Cookie notification messages are now a requirement under the GDPR, CCPA, and other privacy laws. As such, you need to get together with your team and choose a cookie notification message solution that will help you comply with the privacy laws that apply to your website’s users. This will not only protect you from the backlash of the GDPR, COPPA, CCPA, and other laws, but it will also prepare you for upcoming cookie laws such as the EU’s ePrivacy Regulation.