Lawyer Urges Companies to Avoid Generic Cookie Banners

Currently, there are "no generally applicable laws in the U.S. that expressly require opt-in consent from cookies,” said Emma Blaser, partner at the law firm Venable. However, since it's privacy, there are many technicalities and complications, Blaser added. There are many reasons to implement cookie banners, “but mostly now it's to avoid litigation,” since “you can't discriminate against people for exercising their rights.” Specifically, companies “are implementing them to try and avoid opportunistic lawsuits."

Older and broadly written laws like the California Invasion of Privacy Act (CIPA) are being applied to newer technology despite being written before the internet, said Blaser. Some privacy lawyers predict this landscape will change soon (see 2503030050).

“There's really no one-size-fits-all cookie banner anymore,” she added. “It's going to depend on the cookies. It's going to depend on how you want to implement it" and "on what state privacy laws you're subject to, but at a minimum, to be the most effective, you're going to want to reference that there are third-party cookies, specifically -- not just cookies.”

A separate notice for third parties is important because the disclosure of them is usually where litigation stems from, said Blaser. She also said that the more specific a notice is, the harder it is for people to argue they weren’t aware of what was happening.

It's fairly common practice to only surface notices or banners in states that require them. “I live in Maryland, so often, when I'm checking websites at home, I don't see a banner,” she said. “If I were to check the same site from" California "then I would see it.”

What method companies choose depends on what cookies they use, what state laws they're subject to, their risk tolerance and why they're "implementing the banner in the first place,” she said. “At some point, the calculus might change a little bit,” so it’s something “to revisit regularly."