The Parliament is set to adopt new rules regarding cookies and user consent for the processing of traffic data. Websites will need to offer, right from the first level of the interface, a clear option to refuse cookies that require the user’s consent, equally accessible as the accept button. Also, consent can be withdrawn at any time through a simple mechanism.
The draft law amends Law no. 506/2004 and aims to give users real control over the information stored on their devices or accessed by websites and third parties, writes Profit.ro.
What is changing
According to the draft, the interfaces through which websites request users' consent must comply with several rules:
- No pre-checked boxes. Websites will no longer be able to obtain consent through boxes that are already checked, switches activated by default, or other preselected options, except for the exceptions provided by law.
- Refusal, as simple as acceptance. If a website displays a button to accept all cookies, it must also offer at the same interface level a clear option to refuse operations that require consent.
- No hidden or deceptive options. Websites will not be able to use ambiguous wording or interfaces designed so that refusal is more difficult than acceptance.
- Detailed settings cannot replace direct refusal. Users will still be able to configure their preferences, but this option cannot replace an immediate refusal possibility, displayed from the first level of the interface.
- Withdrawal of consent at any time. Users will be able to change their decision through an easily accessible mechanism. Withdrawal of consent must be at least as simple as granting it.
- Clear information about the purpose of processing. Websites must explain, in easy-to-understand language, why information is stored or accessed and how consent can be withdrawn. If third parties are involved, the information must also include the general purpose of the processing carried out by them.
- Proof of consent. Operators must be able to demonstrate that the user gave consent and indicate the moment when it was expressed.
Why the change is important
Currently, many websites display the acceptance of all cookies in a visible button, while refusal requires accessing multiple menus or navigating complicated settings. In this way, users may end up accepting data processing without genuinely wanting to do so.
The new regulation aims to eliminate this difference and turn consent into an effective choice, not a formality. Users should be able to quickly refuse cookies that require their consent without being forced to search for the option through multiple settings pages.
However, the rules do not mean the elimination of all cookies. The draft keeps the exceptions provided by law, and operations that do not require consent according to these exceptions are not subject to the refusal obligation provided for other categories.
What operators must do
Individuals and companies that store information on users' devices or access information already stored will have 120 days from the law's entry into force to comply with the new requirements.
The draft does not impose a unique naming for buttons nor a mandatory technical solution. Operators will be able to choose the implementation method, provided that users' options are clear, visible, and easy to use.