On 7 July 2011, in a public lecture on the privacy implications of “online behavioural advertising”, i.e. the presentation of targeted advertisements on websites based on large scale tracking of consumer behaviour online, the European Data Protection Supervisor (EDPS) called on the European Commission to ensure that Article 5(3) of the e-Privacy Directive is fully respected. According to this provision, as revised in 2009, the storing of information, such as cookies, on computers for tracking purposes is only allowed if the user concerned has given his or her consent, having been provided with clear and comprehensive information about the purposes of the tracking.
Peter Hustinx, EDPS, said: “Systematic tracking and tracing of consumer behaviour online is a highly intrusive practice and is now rightly subject to more stringent requirements. Although initiatives for increased transparency and consumer control in the online environment are most welcome, this should not result in a limitation of consumer rights. The European Commission should avoid any ambiguity as to its determination in making sure that these rights are delivered in the European Union.”
The revised e-Privacy Directive had to be implemented into national law by 25 May 2011. This has only happened in a few Member States and legislation is still pending in most Member States. Up until 2009, Article 5(3) of the Directive only required that users be offered the right to refuse to be subject to online tracking. The new requirement that the user should give his or her consent is still being contested in large parts of the online advertising community. However, national law in Member States which have implemented the e-Privacy Directive is now based on the new consent requirement.
In a speech delivered on 22 June 2011 in Brussels, Commission Vice-President Neelie Kroes, responsible for the EU Digital Agenda, welcomed the recent adoption of a Best Practice Recommendation and Framework on behavioural advertising by EASA and IAB Europe advertising associations. However, these associations have failed to implement the new consent requirement. At the same event, she expressed support for a US driven ‘do-not-track’ initiative that - although valuable - also seems to fall short of the e-Privacy Directive requirements. Unfortunately, this also raises doubts on the position of the European Commission on this subject.