What are the key points to remember from the new cookie checklist published by the DPA in Belgium? How can you easily comply? All the answers in this article.
The Belgian data protection authority has published on October 20, 2023 a new cookies checklist. This presents no new obligations, but has been drafted to encourage the correct use of cookies in Belgium.
The document, which is easy to navigate as it is in the form of a checklist and divided into categories, is intended to serve as a practical tool for businesses. If you operate in Belgium and use cookies, it’s important to familiarize yourself as best you can with the guidelines included in the checklist and to comply with them.
In this article, we’ll give a general review about cookie compliance in Belgium, followed by a recap of the key points highlighted in the checklist, and finally how you can comply. Let’s get started!
Go directly to ⬇️
- Review: cookie use and consent in Belgium
- Which authorities ensure the protection of personal data in Belgium?
- What is the role of a cookie?
- Recap of the APD Belgium cookie checklist
- What are the implications for my organization?
- How to comply as soon as possible
Review: cookie use and consent in Belgium
At the European level – and this includes Belgium – personal data protection is strengthened and centralized with the GDPR or General Data Protection Regulation.
The GDPR introduces fundamental obligations such as the need to have a legal basis, to obtain free, specific, informed and explicit consent and to keep a record of all user consents. The GDPR also defines consumer rights such as the right to access or object, as well as to withdraw consent.
Also in Europe, the ePrivacy Directive or “Cookie Law” (introduced before the GDPR) concerns privacy aspects relating to electronic communications, focusing particularly on cookies and similar technologies.
Under this Directive, websites must obtain user consent before storing or accessing data on their device. In practice, this mainly relates to cookies.
👋 What is the link between the GDPR and the ePrivacy Directive?
The ePrivacy Directive and the GDPR are two distinct legal frameworks. The GDPR, which came into force in 2018, has a broader scope and concerns the protection of personal data in general.
Although it does not deal with cookies specifically, the consent obligations it contains have a notable influence on obtaining consent to cookies under the ePrivacy Directive. For example, both require consent to be specific and explicit, and for users to be able to refuse or withdraw consent at any time.
It’s important to note that the Directive does, however, present its own guidelines.
In accordance with the two above-mentioned laws, case law and good practice, organizations must, among other things:
- have a cookie policy,
- display a cookies banner on the user’s first visit,
- block non-exempted cookies before obtaining user consent,
- install cookies only when informed consent has been given.
💡 Check out our GDPR Cookie Consent Cheatsheet.
The protection of personal data in Belgium is mainly ensured by the Belgian Data Protection Authority or APD, whose mission is to enforce privacy obligations introduced at a European level (by, among others, the GDPR and the ePrivacy Directive). To this end, within the limits of its scope, the DPA intends to use its authority to:
- inform and advise, for example by publishing guidelines to facilitate compliance by organizations in Belgium;
- monitor proper compliance with standards by the country’s private and public players;
- inspect and sanction organizations that do not comply.
Each EU member state has its own DPA, which can be defined as an independent public authority that monitors, through powers of investigation and the adoption of corrective measures, the application of data protection legislation. Depending on where your company is based, the DPA is also your main point of contact for data protection matters.
What is the role of a cookie?
The role of a cookie is to collect or store information about how the user behaves on the Internet(a website) and/or on their device, and to remember their preferences (such as their password or preferred language).
Cookies are small files that are therefore placed on a user’s device, usually on their computer and browser, or phone. The “reading” of these cookies then enables the websites that have placed them to retrieve the information stored in them.
Recap of Belgium’s APD cookie checklist
We’ve summarized below the elements highlighted in Belgium’s APD 2023 cookie checklist.
Some instructions for a good reading of Belgium’s APD cookie checklist
- The list presented is not exhaustive.
- The items listed are not new obligations.
- By the term “cookies”, the document also refers to other tracking mechanisms (e.g. smartphone application trackers, pixel usage, device fingerprinting and local storage).
💡 You can consult the official cookies checklist by following this link.
✅ Cookie consent
- Prior consent: no cookie that is not strictly necessary may be deposited before valid consent has been obtained for this purpose.
- Free consent: “cookie walls” and dark patterns (or “deceptive-design patterns“) are forbidden, the “Accept” and “Decline” buttons on the cookie banner must be at the same level and of the same importance.
- Specific consent: the banner must make it possible to grant consent preferences in more detail and by cookie categories, for each specific purpose and partner (categories must be based on purposes and delimited as clearly and precisely as possible).
- Informed consent: the banner must highlight the purposes in a very clear manner (e.g. bold highlighting or bullets), the entity responsible for depositing/reading cookies (if applicable with an indication of the number of partners and link), how to accept or refuse cookies and the associated consequences, the possibility of withdrawing consent and how to do so. At another level, the list of cookies must be accessible (by category, with purpose, duration and recipients).
- Unambiguous and active consent: consent must be given by a concrete action performed by the user, and cannot be inferred from continued browsing, closing the banner, browser settings or otherwise. Pre-checked boxes are prohibited, including when requesting consent to accept Terms and Conditions or Privacy Policy.
✅ Withdrawal of cookie consent
- It must be as simple for the user to withdraw consent as to give it. The DPA recommends the use of a clearly visible button or link allowing users to manage their expressed cookie preferences and withdraw consent with a single click.
- A withdrawal of consent must actually have the intended effect, and must not merely result in the cookie no longer being set in the future.
✅ Responsibility
- Cookies intended to record the user’s cookie preferences may only be stored for a limited duration (recommended at six months).
- Any information demonstrating that the consent mechanism (such as the banner) has been adapted over time should be retained.
- The cookie policy must have a date and version number. Previous versions must be retained.
👋 What are the implications for my organization?
In its publication of October 20, 2023, the Belgian APD reminds us that cookies are among its priorities for the year 2024. With this in mind, it has published its new checklist, recalling the main elements essential to good compliance relating to the use of cookies by organizations.
👉 If you operate in Belgium, make sure you’re compliant with the Belgian DPA guidelines! Read on to find out how easy it is to comply.
How to get compliant ASAP
At first glance, the Belgian APD checklist may seem laborious and difficult to set up from a technical and legal point of view.
No worries, iubenda has what you need to comply in a matter of minutes:
⭐ Long-standing expertise in online compliance
⭐ All-in-one software solutions for ultra-fast installation on your site via an easy-to-use interface
⭐ Products compliant with current regulations worldwide (EU + Switzerland + UK + USA + Brazil)
👉 Configuration of a customized cookie banner respecting your brand identity
👉 Creation of a professional cookie policy, with +1700 clauses drafted by legal experts
👉 Products constantly updated following the latest privacy developments
❗ Although our products already comply with the majority of the elements set out in the checklist cookies by the Belgium APD, we are in the process of making minor modifications to best meet the requirements and clarifications put forward in the document. 📣 Stay tuned.