Consent exemption
The consent exemption for trackers that are "necessary for the provision of the service requested by the user" originates from article 5.3 of the European ePrivacy directive in 2002.
This directive was subsequently transposed into the various national laws of the European Union's member states, such as France's Data Protection Act (art. 82), or Germany's Telecommunications and Media Data Protection Act (TTDSG - art. 25), for example.
Regarding the specific case of audience measurement trackers, the European Data Protection Board (EDPB) published guidelines back in 2012 specifying that "1st party cookie analytics being strictly limited to the provision of aggregated statistics, having clear information about them, and having appropriate safeguards, do not present a threat to users' privacy and can be exempted from consent" (art. 4.3).
The EDPB confirmed this position in 2023 alongside:
the "cookie banner task force" report (par. 30),
the “Guidelines on Technical Scope of art. 5(3) of ePrivacy Directive” (page 4).
In France, the CNIL published new guidelines and recommendations at the end of 2020 and confirmed the possibility and conditions to benefit from the consent exemption for the use of audience measurement trackers (art. 5, par. 50, 51 et 52).
In March 2021, the CNIL launched an "evaluation program for audience measurement solutions". The list of audience measurement solutions validated by the CNIL, including Piano Analytics / AT Internet, is updated and available via the following link: http://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies-solutions-pour-les-outils-de-mesure-daudience .
In Germany, the DSK (board of all federal authorities) published guidelines at the end of 2022, which, in paragraph 14. audience measurement, set out the prerequisites laid down by ePrivacy for benefiting from the consent exemption, as well as the conclusions of the CNIL's evaluation program for audience measurement solutions (see above).
Finland: 3.3 Examples of different cookie types and guidelines for assessing the need for consent
Greece: Compliance points for data controllers maintaining online data files websites
Ireland: Do analytics cookies require consent?
Italy: 7.2 First-party and third-party analytics cookies
Latvia: Use of cookies to obtain statistics
Luxembourg: 3.1. Les cookies essentiels: pas d’obligation de consentement
United Kingdom: Cookies and similar technologies
Piano Analytics therefore offers a configuration of its solution enabling to benefit from the consent exemption for audience measurement trackers, according to the criteria laid down by ePrivacy, the EDPB and the guidelines of the various European protection authorities.
Note: in paragraph 52 of its 2020 guidelines, the CNIL reminds us "that audience measurement processing operations are personal data processing operations that are subject to all the relevant provisions of the GDPR".
Consequently, it is recommended to provide an opposition / opt-out mechanism also for exempted trackers (see User Rights above). This mechanism may be available in a third level of information, such as the privacy policy or the "cookies page", for example.
Reminder: in addition to the configuration and tagging actions listed above, and to benefit from the ePrivacy exemption and collect audience measurement data without consent, it is necessary to sign the specific exemption appendix of our Data Processing Agreement (DPA).