Italian DPA Sanctions Controller for Improper Cookie Consent Legal Basis
The controller attempted to substitute user consent with 'legitimate interest' as the legal basis for cookie processing — a basis explicitly prohibited under the ePrivacy Directive for non-essential cookies. This reflects a fundamental misunderstanding (or deliberate circumvention) of the legal hierarchy between GDPR and sector-specific legislation like ePrivacy, where ePrivacy takes precedence for electronic communications. The case also highlights that national DPAs retain enforcement authority over the ePrivacy Directive even when GDPR's one-stop-shop mechanism designates a lead supervisory authority elsewhere. Organizations operating across the EU must account for both GDPR and national ePrivacy implementations simultaneously, as compliance with one does not guarantee compliance with the other.
Tactical Insight
Immediate actions
- Audit all current cookie banners and privacy policies to ensure non-essential cookies rely exclusively on freely given, informed user consent.
- Remove any reliance on 'legitimate interest' as a legal basis for cookie or tracker deployment and update privacy documentation accordingly.
Long-term improvements
- Establish a cross-functional privacy governance process that maps each data processing activity to the correct legal basis under both GDPR and applicable national ePrivacy laws.
- Engage legal counsel with multi-jurisdictional EU expertise when drafting or updating privacy policies to avoid conflating GDPR flexibility with ePrivacy's stricter consent requirements.
- Maintain a living Record of Processing Activities (RoPA) that is reviewed and updated whenever privacy policies or cookie configurations change.
Detection & monitoring measures
- Implement periodic third-party cookie audits to detect any technical drift between stated policy and actual cookie behavior on live web properties.
- Subscribe to DPA guidance updates across all EU member states where the organization operates to monitor evolving enforcement interpretations of ePrivacy rules.