you are being redirected

You will be redirected to the website of our parent company, Schönherr Rechtsanwälte GmbH :

29 June 2020

The cookie monster vs. the law – now live on TV

HbbTV: the stumbling block

Cookie banners have become a common sight for internet users in Europe. Recently the first cookie banners also appeared on Austrian TV screens.1 This is a side effect of the hybrid broadcast broadband TV ("HbbTV") standard, which merges classical television with the internet. HbbTV offers a broad variety of new services to viewers, such as an electronic programme guide, video on demand, "super text" (an advanced teletext with a more attractive user interface with more information), games, and much more. All these services are accessible on the TV screen without the need to switch the channel. 
On the other hand, HbbTV enables broadcasters to track the viewing habits of their audience in real time with great accuracy to optimise strategic programming and advertising. To this end, broadcasters use conventional web analytics services like Google Analytics, which in turn are based on cookies and similar technologies to make the individual devices identifiable. In February 2020, the HbbTV TA standard was introduced, replacing generic TV commercials in a linear broadcast feed with targeted ads delivered via broadband. Targeted advertising also relies on unique identifiers, provided e.g. via cookies or device IDs.

The ePrivacy Directive

Art. 5 (3) of the ePrivacy Directive (ePD) requires the user's consent when using electronic communications networks to store or access information on the user's device. If storage or access is technically necessary for the provision of the service, no consent is required. In any case, however, the user must be informed about such activity. This provision is the legal origin of all cookie banners. Whenever a website uses cookies, users must be informed. Since cookies used for targeted ads or web analytics are not technically necessary to operate a website, they require the user's consent. This approach is commonly referred to as "notice and consent".

It is important to point out that Art. 5 (3) ePD is technology neutral. First, its scope is not limited to cookies but covers all technologies that store or access data on users' devices. Art. 5 (3) ePD thus also covers inter alia web storage, fingerprinting, or accessing a device-ID or advertising-ID. Second, it does not only apply to surfing the web on a computer but to the usage of electronic communications networks in general by all kinds of devices. 

HbbTV typically uses the internet to access unique identifiers that are stored on a device. Art. 5 (3) ePD therefore applies and viewers must be informed and, where necessary, asked for their consent. 

More privacy?

Since HbbTV has become a common standard in Europe, cookie banners will soon become prevalent on TV screens as well. But do cookie banners actually strengthen viewers' privacy?

Providing information on how data is used obviously is important and cookie banners as well as privacy policies therefore serve a very legitimate purpose. However, a 2018 study showed that half of all participants considered the likelihood that they would click on the link in a cookie banner to receive additional information to be less than 13 %.2 Those few users who actually want additional information may face serious challenges: An analysis of 150 privacy policies showed that the vast majority require at least college reading level.3 Most privacy policies, which tend to be verbose and full of legal and technical jargon, are therefore incomprehensible for the average reader.

And if people do not understand how data is used, how can they give their consent? To be legally valid, consent must be informed, meaning the permission must be granted in full knowledge of the consequences. For the average person without any prior knowledge of privacy law, cookies or the internet protocol suite, giving informed consent seems almost impossible. Furthermore, most requests for consent seen on the internet or on TV do not comply with basic design requirements, in particular the need to give a choice to either accept or reject the use of cookies. In August 2018, only 3.2 % of the most popular websites in the EU provided such a binary option in their cookie banners, while 57.4 % of the websites used so-called "dark patterns", i.e. interface designs that try to guide users to desired behaviour through malicious interaction flows.4 Another study showed that 11.6 % of the analysed websites stored a positive consent before the user has made a choice in the banner; 5.3 % simply did not respect the user's choice at all.5

Different privacy!

HbbTV has brought cookie banners onto our TV screens. But will it stop there? Analytics of usage behaviour and targeted ads are also a common phenomenon on mobile apps, yet cookie banners or requests for consent are still scarce.

For most users, cookie banners remain an annoying phenomenon. And those cookie banners which do not comply with the law are indeed just that. But the ultimate question should not be "How to achieve better compliance?" but rather "How to achieve better user privacy?" This goal may require a change of direction. Privacy should not be the concern merely of the website publisher, mobile app developer or TV broadcaster. Rather, privacy should be integral to the underlying technical standards itself. Whenever a new standard is developed, such as HbbTV, the protection of privacy should be considered right from the start. In the authors' opinion, this is what privacy by design should actually mean in practice.

Kulyk/Hilt/Gerber/Volkamer, "This Website Uses Cookies": Users' Perceptions and Reactions to the Cookie Disclaimer

Utz/Degeling/Fahl/Schaub/Holz, (Un)informed Consent: Studying GDPR Consent Notices in the Field

Matte/Bielova/Sanots, Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework



austria vienna