Squeezemind S.r.l. – Violation Found (Italy, 2025)

Cookiemetrix is an online service that analyses the cookies on websites and suggests whether or not they require the consent of the end users. Cookiemetrix is marketed as a tool to aid companies comply with EU data protection law and is available under both a free and a paid subscription. In October 2024 the DPA carried out an ex-officio investigation against Squeezemind s.r.l. - the controller and owner or Cookiemetrix. The DPA investigated both the functioning of Cookiemetrix and the use of cookies on the controller’s website. = The controller’s website displayed a cookie banner which allowed users to accept “advertisement cookies” or to browse the website with only strictly necessary cookies. This preference was stored in a cookie - a common practice for many websites. The investigation found that despite the wording of the cookie banner, the website never used advertising cookies. In this regard, the controller explained that it removed advertising cookies from its website years before the investigation took place, but forgot to change or deactivate the cookie banner. = Cookiemetrix analysed and labelled cookies in several steps. First, Cookiemetrix crawled a web page, listed all the cookies that the page attempt to write, and assessed which of those cookies were conditional on the user's consentTo this end, Cookiemetrix would actually crawl each page twice. In one crawl, Cookiemetrix would simulate consenting to any cookie pop-ups on the page; in the other, it would simulate rejecting consent. By comparing the results, Cookiemetrix learned not only what cookies were written but also which cookies were conditional on the user's consent.. Then, Cookiemetrix matched these cookies against an open-source library of known cookies and labelled each cookie as “essential” (i.e.: requiring consent under the law) or “non-essential” (i.e.: when the cookies fell under one of the exemptions of the ePrivacy Directive) according to the library. Finally, Cookiemetrix provided users with a report on the website’s compliance with data protection law. A website would be classified as compliant when, according to the previous steps, it did not write non-essential cookies without user consent. Cookiemetrix’ final reports included a disclaimer clarifying that the report itself did not guarantee compliance with data protection law and suggesting that the user consult a legal professional. However, no such disclaimer was displayed on the website’s home page: users were only provided with the disclaimed after Cookiemetrix had scanned their websites. The DPA considered that Cookiemetrix did not allow for a reliable assessment of the compliance of cookie practices and that the controller was not entirely transparent about this with its customers. On these grounds, the DPA took the initial view that the controller violated Articles 5(1)(a) and (d) GDPR. In its defense, the controller claimed that the disclaimer was sufficient to ensure full transparency and that, in any case, the DPA was not competent to sanction the controller for providing a service in an allegededly non-transparent way. As mentioned above, the controller stored visitors’ cookie preferences in a cookie. In light of the IAB Europe ruling of the CJEU, the DPA held that this cookie constituted personal dataThe decision is surprisingly scant on this point. The DPA mentioned that, according IAB Europe, similar cookies may constitute personal data "under some conditions" but did not elaborate further. There is no clarification as to why cookie preferences constitued personal data in the case at hand.. The DPA also considered this processing of personal data to be entirely unnecessary because the website did not use advertising cookies and effectively used the same cookies regardless of visitors’ preferences. On these grounds, the DPA held that the controller violated: * A number of transparency provisions of the GDPR (Articles 5(1)(a), 12, and 13 GDPR); * The principle of data minimisation (Article 5(1)(c) GDPR); * The Italian implementation of Article 5(3) of the ePrivacy Directive (i.e.: Article 122 of d. lgs. 196/2003). On this basis, the DPA issued a warning for violating these provisions. The DPA accepted the controller’s argument that it was not competent to sanction the alleged lack of transparency of the Cookiemetrix service. So, the DPA did not take action or issue any finding relative to Cookiemetrix.