Important here is that consent must be specific, informed, unambiguous and freely given. In addition, visitors from the EEA (European Economic Area) must be clearly informed about what data is being collected, for what purpose, and for how long it is kept.
The reason for these legislations is that cookies collect information about the user, such as browsing habits, preferences and sometimes personal data. Since this data is considered personal data under the AVG, protecting users' privacy is a legal obligation. The transparency principle must also be met by informing users about how their data is collected, processed and transmitted to any third parties.
Informing users about the use of cookies and requiring their explicit consent before non-essential cookies are placed gives users control over their personal data. They can decide for themselves whether they agree to the use of cookies and specify by category which types of cookies they want to accept or reject.
For these reasons, websites are required to display cookie banners and allow users to give informed consent before non-essential cookies are set. Strictly necessary cookies (such as those for shopping baskets or login functionality) do not require explicit consent. In this way, websites comply with AVG requirements regarding transparency, lawfulness of processing, and ensuring users' control over their personal data.
If you don't use a cookie banner on your website while setting non-essential cookies, you risk significant fines under the AVG. The maximum fine can be up to €20 million or 4% of your annual global turnover. In addition to financial penalties, you could also face warnings, reprimands, or a temporary ban on data processing. Regulators such as the Personal Data Authority can take enforcement action following complaints from visitors or during routine audits. In addition, missing a cookie banner damages visitors' trust and can damage your reputation. It can also expose you to potential civil claims from individuals whose privacy rights have been violated.
If users ignore your cookie banner, there are several consequences. On a properly set up "opt-in" website (as required by the AVG), no non-essential cookies may be set until the user gives explicit permission. You may then set only strictly necessary cookies, and not use tracking, marketing or analytical cookies. Many websites continue to display the cookie banner on each visit until a choice is made, ultimately forcing users to make a decision. If a visitor ignores the cookie banner on page one of session one, and only accepts the cookies on a later page in their session you will not be able to read their UTM parameters from your tracking setup, among other things. For more information on setting up a cookie banner and the theory on making a cookie banner un-negatable, please refer to this blog article on setting up a cookie banner via Google Tag Manager.
First-party cookies are not required by websites. These cookies are set by the website you visit and can help improve the user experience by, for example, remembering login information or storing items in a shopping cart. Websites can function perfectly well without first-party cookies, although some functionality may then be limited. For essential functions, such as keeping a shopping cart or remembering login information, first-party cookies are often necessary.
It is important to note that even first-party cookies that are not strictly necessary for the functioning of the website still require user consent. Here, the AVG law does not distinguish between first-party and third-party cookies, but looks at the purpose for which they are used. Incidentally, given the announced end of third-party cookies for website tracking, first-party cookies are becoming increasingly important for marketers and companies to collect relevant user data.
You can delete cookies in your browser's settings. In Chrome, Safari, Firefox and Edge, you'll find this under "Privacy" or "History. Usually you can choose between deleting all cookies or only those from specific websites. On smartphones, you can delete cookies through the settings of your mobile browser or through the settings of the device itself.