The new rules about profiling cookies in Italy.

The Italian Government introduced new rules about web profiling and about the installation of cookies by websites. Starting on June 3rd, 2015, the measure “Individuation of simplified modalities for information and consent to the use of cookies,” issued by the Privacy Authority last year, will be in effect.

The owners of websites that use profiling cookies need to adapt their pages, in order to avoid expensive penalties.

How to bring a website up to the new standards

Websites that use profiling cookies must display a banner on homepage opening. The banner must meet the following criterions:

• it must be very evident. In order to close it, a specific action by the user is required;
• it must specify that the website takes advantage of profiling cookies;
• it must include a specific approval button or, as an alternative, it must specify that if users go on with their navigation, they are implicitly accepting the use of profiling cookies. Users’ registration to other services, such as newsletters, can’t be conditioned to the approval of different clauses, such as cookies installation;
• it must include a link to the complete information, which must meet the following criterions:

1. it must specify the purposes of cookies installation;
2. it must give users the possibility to select or deselect each cookie;
3. it must inform users about the use of third parties cookies;
4. it must provide the users with instructions about how to modify their browser’s preferences in order to reject all or some of the cookies.

Before starting data processing, companies must fill in and submit a specific form available on the website of the Privacy Authority. The supplier of the service must nominate who is in charge of the processing of personal information and, possibly, the System Administrator. These data, if needed, must be included in the complete information.

Fines and penalties

Fines are very onerous, especially for start-ups. They can vary from 20,000 to 120,000 Euros. Measures could also be published, with consequent damage for the reputation of the guilty company. Besides, in case of false data or documents, penal measures can be applied (six months to three years detention).