# Cookie Audit Standards and Legal References

## Primary Legal Framework

### CJEU Case C-673/17 — Planet49 GmbH v. Bundesverband der Verbraucherzentralen
- **Court**: Court of Justice of the European Union (Grand Chamber)
- **Date**: 1 October 2019
- **Key Holdings**:
  - Pre-ticked checkboxes do not constitute valid consent for cookies (para. 62)
  - Consent must be active and specific — a general acceptance of terms is insufficient
  - Users must be informed about cookie duration before consenting (para. 81)
  - Users must be informed about whether third parties have access to cookies (para. 81)
  - These requirements apply regardless of whether cookies contain personal data
- **Relevance to Cookie Audits**: Audits must verify that consent mechanisms use active opt-in, that cookie duration is accurately disclosed, and that third-party access is documented

### ePrivacy Directive 2002/58/EC (as amended by 2009/136/EC)
- **Article 5(3)**: Consent required for storing or accessing information on user terminal equipment
- **Exemption**: Storage "strictly necessary" for the service explicitly requested by the user
- **Transposition**: Each EU member state has transposed Article 5(3) into national law with minor variations

### GDPR (Regulation 2016/679)
- **Article 4(11)**: Definition of consent — freely given, specific, informed, unambiguous indication by statement or clear affirmative action
- **Article 7**: Conditions for consent — demonstrability, distinguishability, withdrawal right
- **Article 13-14**: Information requirements applicable to cookie data collection

## Cookie Classification Standards

### ICC UK Cookie Guide (2012)
- Published by the International Chamber of Commerce UK
- Establishes four cookie categories:
  1. Strictly Necessary Cookies
  2. Performance Cookies (analytics)
  3. Functionality Cookies (preferences)
  4. Targeting/Advertising Cookies
- Widely adopted as the standard classification framework by CMPs and regulators

### Article 29 Working Party Opinion 04/2012 (WP 194)
- Title: "Opinion 04/2012 on Cookie Consent Exemption"
- Defines criteria for strictly necessary exemption under Article 5(3)
- Categories: user input, authentication, security, multimedia, load balancing, UI customisation

## Regulatory Guidance

### CNIL Deliberation No. 2020-091 (17 September 2020)
- French implementation of cookie consent requirements
- Key points: equal prominence for accept/reject, no cookie walls, 6-month reconsent, 13-month maximum cookie duration

### EDPB Guidelines 05/2020 on Consent under Regulation 2016/679
- European Data Protection Board guidance on valid consent
- Applies to cookie consent via GDPR Article 4(11) definition
- Addresses: scrolling as consent (invalid), cookie walls (generally invalid), granularity

### UK ICO Guidance on Cookies and Similar Technologies
- Updated 2023
- Practical guidance for PECR Regulation 6 compliance
- Addresses: analytics cookies require consent, consent mechanisms, cookie audit recommendations