Skip Repeated Content

56.6%

The term “cookie banner” refers to a banner, or splash page, deployed on a website to inform visitors that the website uses cookies.  Most cookie banners fall within three categories:

  1. Notice Only.  A “notice only” cookie banner discloses to visitors that the website deploys cookies, but does not give the website visitor any direct control concerning the use of cookies.  In other words, the website visitor is not asked to permit / accept cookies, nor are they given a tool or mechanism for disabling cookies.  Some notice-only cookie banners may, however, provide information to the visitor on how cookies can be disabled within the visitor’s website browser.
  2. Notice + Opt Out Consent. A “notice + opt out” cookie banner discloses to visitors that the website deploys cookies and provides the visitor with a mechanism for disabling the use of cookies on the website in the future.  This may include a single option to “opt-out” of all cookies, or might provide a more granular option to opt-out of some types of cookies (e.g., behavioral advertising cookies) but no option with regard to other cookies (e.g., cookies necessary for the website to function).
  3. Notice + Opt In Consent.  A “notice + opt in consent” cookie banner discloses to consumers that the website would like deploy cookies and asks the visitor to opt-in to the use of cookies before the cookies are deployed.  This may include a single option to “opt in” to all cookies wherein no cookies will be placed on the browser absent consent, or it might provide a more granular option to opt-in to some types of cookies (e.g., behavioral advertising cookies), but no option with regard to other cookies (e.g., cookies necessary for the website to function).

While a significant number of Fortune 500 companies deploy a “notice + opt-in consent” cookie banner, some of those banners appear to have no impact on whether the website actually deploys cookies.  Put differently whether a website visitor opts-in (e.g., clicks “agree”) or does not opt-in (e.g., clicks “reject”) the website continues to deploy the same number of advertising cookies. 

In order to determine the rate of cookie banner deployment, BCLP reviewed the websites of each company listed on the Fortune 500.1  BCLP’s full analysis, which is available to firm clients, includes the rate of cookie banner deployment broken down by industry, the quantity of advertising cookies deployed between industries, and the number of companies that do, and do not, classify their use of advertising cookies as the “sale” of personal information. 

Based upon our study, 56.6% of companies that utilized a cookie banner that purported to seek opt-in consent did not, in fact, alter the quantity of cookies deployed based upon whether a visitor agreed to the banner.

For more information and resources about the CCPA visit http://www.CCPA-info.com. 

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. Websites of each company were reviewed during the first quarter of 2020 from an IP address associated with Los Angeles, California, using Chrome for iOS Version 79.0.3945.88 (official build) (64 bit).  Advertising cookies were identified using Ghostery for Chrome Version 8.4.4.  In situations in which a Fortune 500 company was a holding company that did not operate a significant website, the website of one of the holding company’s operating units was examined.

This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.