This article is also available in:
Deutsch: Artikel 29 Gruppe über Ausnahmen für den Einsatz von Cookies

On 12 June 2012, the Article 29 Working Party (WP 29) published an opinion on the issue, focusing on two exemption criteria established by the new cookie-related provisions in the ePrivacy Directive:

A- the use of the cookie “for the sole purpose of carrying out the transmission of a communication over an electronic communications network” and B - the use of a cookie if “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”.

WP 29 established in its opinion the circumstances when the exemption criteria do not apply such as forcing controllers, processors, and third party actors to obtain informed consent before using a cookie.

As regarding criterion A, the WP 29 considers this exemption can be used only when the cookies are pivotal to the transmission of the communication and when the transmission is not be possible without the use of the cookies. "Simply using a cookie to assist, speed up or regulate the transmission of a communication over an electronic communications network is not sufficient," says the opinion.

Regarding criterion B, the opinion says: "There has to be a clear link between the strict necessity of a cookie and the delivery of the service explicitly requested by the user for the exemption to apply."

Cookies served for the purposes of providing a specific functionality within websites will not be considered “strictly necessary” unless "the functionality will not be available" without the cookie and the user has "explicitly requested" the functionality from the website.

According to the opinion, some cookies can be exempted from informed consent under certain conditions if they are not used for additional purposes - these cookies include for example “user-input” cookies (used to keep track of the user’s input when filling online forms or as a shopping cart, also known as session-id cookies), multimedia player session cookies and user interface customization cookies (for example language preference cookies to remember the language selected by a user).

The cookies that should not be covered by the exemption include social plug-in tracking cookies; third party advertising cookies, third party and first party analytics cookies.

Regarding third party and first party analytics cookies, WP 29 remarks however that they carry low privacy risks when they are limited to first party aggregated statistical purposes and when used by websites which also provide adequate privacy safeguards.

WP 29 also believes e-Privacy Directive should be amended in order to introduce a new exemption to consent "for cookies that are strictly limited to first party anonymized and aggregated statistical purposes."

Opinion 04/2012 on Cookie Consent Exemption (7.06.2012)
http://ec.europa.eu/justice/data-protection/article-29/documentation/o...

Article 29 Press Release on cookie consent exemption (12.06.2012)
http://www.statewatch.org/news/2012/jun/eu-wp-29-dp-cookies.pdf

Websites may only place cookies without user consent if services would not work without them, say regulators (13.06.2012)
http://www.out-law.com/en/articles/2012/june/websites-may-only-place-c...