Società Onlinestore s.r.l. – Violation Found (Italy, 2024)

The Italian supervisory authority investigated the cookie practices of the www.onlinestore.it website on its own volition. The website belonged to e-commerce company Società Onlinestore S.r.l. (the data controller). The website’s cookie banner stated that the website used cookies (including third-party cookies) to offer a better browser experience and that users could edit their cookie preferences. The banner included three options: “Accept”, “Customize”, and “Learn more”. The banner included no option to reject cookies and no “X” iconThe authority's cookie guidelines recommend the use of an "X" button. The "X" must be positioned in the upper right corner of the banner, like the "close" option of many programs. Clicking the "X" button dismisses the banner and rejects all non-necessary cookies, much like a "Reject All" option. See [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876 Garante per la protezione dei dati personali (Italy) - 9677876]. to close the banner. The “Customized” option opened a drop-down menu with preferences for both necessary cookies and profiling cookies. Profiling cookies were pre-selected by default and could be de-selected by the user. The authority tested the website and found that the same number of cookies were placed regardless of user preference. In its preliminary view, the authority held that the data controller did not allow users to express informed, freely given, and granular consent. The authority also held that the controller failed to provide users with a clear and transparent cookie notice. In the authority’s view, the controller violated Articles 4(11), 5, 7, 24, and 25 GDPR, [https://www.gazzettaufficiale.it/dettaglio/codici/datiPersonali Article 122 d. lgs. 196/2003]This Article is the Italian implementation of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 Article 5(3) ePrivacy Directive 2002/58/EC]., and the authority's guidelines on cookies and other trackers[https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876 Garante per la protezione dei dati personali (Italy) - 9677876]. The data controller took the website offline as soon as it was informed of the investigation. The controller did not challenge the authority’s views and stated that it did not assess the compliance of its cookie implementation. The authority held that the data controller violated Articles 4(11), 5, 7, 24, and 25 GDPR, [https://www.gazzettaufficiale.it/dettaglio/codici/datiPersonali Article 122 d, lgs. 196/2003], and [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876 the authority's guidelines on cookies and other trackers]. The authority only issued a warning because the controller immediately took the website offiline. The authority also ordered the data controller to address its non-compliant cookie practices, should it make its website available again.