In short: Under the guidelines of the Garante, Italy's data protection authority (10 June 2021), a website must not set any cookies other than technical ones when someone first lands on it. The banner needs an X to close it, a button to accept everything, an area for granular choices set to refuse by default, and controls with equal visual prominence. Scrolling is not consent and a cookie wall is unlawful.
The cookie banner is the part of privacy compliance that everyone sees and almost everyone gets wrong. The Garante per la protezione dei dati personali, the Italian data protection authority, set out the rules in its guidelines of 10 June 2021, published in the Gazzetta Ufficiale, Italy's official journal, on 9 July 2021 with six months to comply. They are not an opinion: they are the yardstick by which a website is judged in Italy.
This is a practical guide, not legal advice.
The starting rule
On the first visit the site must not set cookies or any other tools except technical ones, and must not use active or passive tracking techniques such as fingerprinting. Profiling and marketing tools only start after consent.
- Technical cookies: needed for the site to work (basket, login, security, language). A privacy notice and a cookie policy are enough.
- Analytics cookies: treated like technical cookies only under specific conditions (see below).
- Profiling and marketing cookies: advertising pixels, retargeting, social media. They require prior consent.
What the banner must look like
Under the guidelines, the banner must:
- Appear on the first visit and create a noticeable break in browsing.
- Have an X to close it that keeps the default settings: no non-technical cookies. Closing the banner means carrying on without being tracked.
- Offer a button to accept all cookies, with the same visual prominence as the other controls.
- Provide an area for granular choices by purpose, with every box set to refuse by default.
- Include a link to the cookie policy and to the privacy information.
- Let people change their mind at any time through a link that can always be reached.
Scrolling and cookie walls
Scrolling down the page is not enough to give consent. It can only play a part in a process where the user takes a positive action that the system can record. A cookie wall (blocking the site for anyone who does not accept cookies) is considered unlawful. The exceptions are cases, assessed one by one, where there is an equivalent alternative way to access the service.
When to show the banner again
Someone who has refused should not see the banner on every visit: their choice must be recorded. You may show it again in only three cases:
- the conditions of the processing change significantly, for example new third parties come in;
- there is no way of knowing whether a cookie is already stored on the device;
- at least six months have passed since it was last shown.
Analytics cookies: when they are exempt
Statistics tools can be treated as technical cookies only if:
- they are used for aggregate statistics on a single website or app;
- their ability to identify people is reduced, as a rule by masking at least the fourth part of the IPv4 address;
- the third-party provider does not combine the data with other processing and does not make it possible to identify the person directly.
With the standard settings of many tools these conditions are not met: it has to be checked case by case.
Proof of consent
The data controller must be able to document each user's choices with digital records and keep that documentation up to date. In practice you need a consent log with the date and the version of the banner. Consents collected earlier remain valid only if they comply and were recorded in a way that can be documented.
A ten-minute check
- Open the site in a private window without touching the banner.
- Open the browser's developer tools and look at the cookies and network requests.
- Check that there are no cookies and no requests to pixels or marketing services before consent.
- Close the banner with the X and check that nothing fires.
- Accept, then reload and check that your choice is remembered.
- Refuse in a new private window and run the check again.
- Check that the link to change your choices can always be reached.
Further reading: privacy for an online shop · server-side tracking
Frequently asked questions
Does scrolling the page count as consent to cookies?
No. Under the Garante's guidelines, scrolling on its own is not valid consent. It can be part of a more structured process in which the user takes a positive action that can be recorded.
How long before I can show the banner again to someone who refused?
The choice must be recorded and the banner should not reappear on every visit. It can be shown again if the conditions of the processing change significantly, if there is no way of knowing that the cookie is already stored on the device, or once at least six months have passed since it was last shown.
Do Google Analytics cookies require consent?
It depends on how they are configured. Analytics cookies are treated like technical cookies, and so exempt from consent, only if they are limited to aggregate statistics on a single site, if their ability to identify people is reduced (as a rule by masking at least the fourth part of the IPv4 address) and if the provider does not combine the data with other processing.
Is a cookie wall allowed?
In principle, no. Forcing people to accept cookies to access the site is considered unlawful unless an equivalent alternative is offered, which has to be assessed case by case.