The proposed ePrivacy regulation definitively states that prior consent is needed for almost any data usage (and not only personal data). Furthermore, the proposed regulation aims at giving consumers control of their settings, by providing a way to accept or refuse tracking cookies and other identifiers in case of privacy risks in their browser settings.

The European Commission recently presented a legislative proposal for an ePrivacy Regulation concerning the respect for private life and personal data in electronic communications and repealing the existing Directive 2002/58/EC (last modified in 2009). The proposal replaces the so-called cookie provision, which has been heavily criticized for not being uniformly implemented across Europe, and thereby creating legal uncertainty. 

According to Vice President Ansip, the proposed regulation will enable Internet users to make an informed choice when it comes to accepting or refusing tracking cookies and other identifiers. The main purpose of tracking cookies is to identify users and possibly prepare customized journalistic content and advertisements for them. According to the Commission, most internet users simply accept every cookie request and the Commission seeks to create more transparency and respect for private life in electronic communications.

The proposal clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history). Cookies set by a visited website counting the number of visitors to that website will no longer require consent.

New rules might change media landscape

Advertising is one of the main resources of online journalism. If more Internet users would disable tracking cookies, it would be harder to use targeted advertisement. This could seriously undermine the ability of web companies and news websites to generate advertising income. 

Furthermore, market players who have access to large amounts of first-party data through their direct and inherent relationship with logged-in users will benefit from a competitive advantage.

On the other hand, the new rules could also change the way in which advertisers reach their audiences. If programmatic data-driven advertising will be less effective, advertisers might use more online display advertisements.

In that sense, the new legal framework could form a basis for sustainable online business models.

Detection of adblockers allowed

The proposed regulation acknowledges that websites are allowed to detect whether or not their visitors are using ad block technologies.

Many news websites use this method to ask visitors who are using ad block technologies to turn it off or to deny them from access to valuable content.

Consent needed for direct marketing

In general, the proposed regulation requires consent of consumers before companies are allowed to use direct marketing communication techniques to contact them.
The proposed regulation explicitly allows companies to use e-mail contact details within the context of an existing customer relationship for the offering of similar products or services.

Next steps: ambitious timeline

Before becoming law, the proposed regulation will first require approval from the European Parliament and member states, before seeking adoption by the 25 May 2018 alongside the already ratified General Data Protection Regulation.

This schedule seems ambitious. The European Parliament and the member states usually take their time for new privacy legislation. It is also expected that internet companies and advertisers will use their influence to weaken the proposal.

Contribution by Sebastiaan Moll

Policy advisor at NDP Nieuwsmedia and member of NME Advertising Taskforce