Cookie identifiers which, when combined with other identifiers and information, lead to the identification of an individual. physical data are treated as personal data.
Placing and reading cookies requires consent (Article 173 of the Telecommunications Law).
Due to the fact that some cookies contribute to the collection of personal data, the general principles of the GDPR apply. The legal basis for the processing of this data will be Art. 6 section 1 letter b b (consent) or Art. 6 section 1 letter f (legitimate interest).
In order for the conditions for correctly granted consent to be met, three conditions should be met:
1. Cookies may only be placed after consent is given,
2. The user will receive appropriate information resulting from the GDPR and the Act. telecom,
Information that must be there:
what cookies are used and for what purposes, how the user can change cookie settings,
3. The user must take some action to express consent, e.g. click I agree or
go to the website.
The above conditions can be met by placing a pop-up or a bar asking for consent on the website.
Art. 174 section 2 allows the possibility of expressing consent through appropriate settings in the browser, but most lawyers are of the opinion that this is not sufficient to meet the conditions for expressing consent.
Summary: when using Google Analitics, remarketing, tracking or analytics tools on your website, you must post a message and obtain consent because there are cookies
+ processing of personal data.
Importantly, consent to cookies should be archived by the administrator.