Cookies & Co. - legally toxic cookies?

Marketers are hungry, hungry for customer and user data. That is in the nature of things. Since the advent of IT, they are also constantly being given new, more efficient tools for data procurement and data analysis. These have increased exponentially since the Internet. This has also brought politicians onto the scene, who have introduced the Data Protection Act at the same time and continuously adapted it to the new technical possibilities. The Data Protection Act forms the essential legal basis for online marketing with cookies and other tools for analyzing customer and user behavior on the Internet. However, only so-called "personal data" is covered by the Data Protection Act. This is data that allows direct conclusions to be drawn about a natural or legal person. According to the Federal Data Protection Commissioner, this also includes IP addresses, although these generally only allow conclusions to be drawn about the corresponding access provider, as the associated user data may only be disclosed by the latter if there is reasonable suspicion of a criminal offense and only to the criminal authorities. This means that marketers who use cookies and analysis tools for websites, such as Google Analytics, must also adhere to the principles of data protection. The principles of lawfulness, transparency, proportionality, purpose limitation and security are particularly important.

With regard to both cookies and analysis tools, this means that the operator of a website must explicitly refer to the use of these tools in the general terms and conditions of use, usually as part of a data processing declaration. If the website is also accessed in the European Union or is also aimed at this market, the EU's ePrivacy Directive also requires that the user must explicitly consent to the placement of a cookie on their PC, e.g. by clicking on a consent box in a pop-up. This corresponds to the opt-in principle already familiar in connection with commercial emails. In the case of third-party analysis tools, it is important that they do not use the data provided by the website operator for their own purposes and that they guarantee data security. If tools from foreign providers are used, the provisions of the Data Protection Act regarding the transfer of personal data abroad must also be observed. The Data Protection Act requires that the country to which the data is delivered guarantees "adequate data protection". From the perspective of Switzerland and the Federal Data Protection Commissioner, the provider in the USA must have signed up to the "U.S.-Swiss Safe Harbor Framework", which Google in particular has also done. In addition, the Federal Data Protection Commissioner requires the website operator to ensure that the last digits of the IP address are made unrecognizable through appropriate settings in the program code, which is particularly easy to do with Google Analytics.

If these principles are observed, cookies and analysis tools can contribute to the simplification and optimization of websites for both the website operator and the user without becoming "legally poisonous cookies" for the website operator. Further information at www.edoeb.admin.ch and in the book "Kommunikationsrecht.ch"

Ueli Grüter