The box that pops up when you open almost any website has become an automatic gesture: one click on "Accept" to make it go away. Yet that choice decides whether the site, and often dozens of third-party companies, can follow you as you browse. Understanding what lies behind the options lets you decide in a few seconds without giving up your privacy.
Where the rules come from
Cookie rules do not come from the GDPR alone. Their basis is Directive 2002/58/EC, known as the ePrivacy Directive, whose Article 5(3) requires the user's consent for storing information on their device or accessing information already stored there, unless it is strictly necessary. In Italy the rule is transposed by Article 122 of the Personal Data Protection Code. The GDPR, in turn, defines what valid consent means: freely given, specific, informed and unambiguous. The Italian data protection authority, the Garante, has also adopted specific guidelines on cookies and other tracking tools.
Types of cookies, in plain words
| Type | What it does | Is consent needed? |
|---|---|---|
| Technical | Keeps your basket, remembers your language, manages login to a private area | No |
| First-party analytics with safeguards | Counts visits in aggregate form without identifying individuals | Generally no, if they meet the conditions set by the authority |
| Third-party analytics without safeguards | Statistics processed by outside companies that may combine data | Yes |
| Profiling | Builds a profile of your interests to show you targeted advertising | Yes |
The key distinction is between what is needed to run the site you chose to visit and what serves other purposes, above all advertising.
What a proper banner must do
According to the Garante's guidance, a compliant banner must follow certain principles.
- Refusing must be as easy as accepting. The control for closing the banner, typically an X in the top-right corner, must keep the default settings, meaning no profiling cookies.
- Scrolling is not consent. Continuing to read or scroll does not amount to accepting.
- Boxes cannot be pre-ticked. Consent must come from a positive action.
- There must be access to detailed choices. A link such as "Customise" or "Preferences" must let you choose by category.
- A cookie wall is, as a rule, unlawful. Making access to the site conditional on accepting profiling cookies, with no alternative, is not considered freely given consent.
- Your choice must be changeable. The site must offer a way to review consent later, for instance a link in the footer.
How to decide in a few seconds
- Look for the "Reject" button or the X. If it is there, it is the quickest way to limit tracking.
- If you only see "Accept" and "Customise", open the preferences: non-essential categories can often be switched off with a "Reject all" button inside the panel.
- Watch out for "legitimate interest". Some panels show a second tab where dozens of vendors are switched on by default on the basis of legitimate interest. If you want to limit profiling, check that tab too.
- Do not worry about losing features. Cookies needed for the site to work do not require consent and stay active even if you refuse everything else.
The browser as a second line of defence
The choices you make in a banner apply to a single site. The browser lets you add general rules.
- Blocking third-party cookies in the privacy settings reduces tracking across different sites.
- Deleting cookies regularly, or setting them to be deleted when the browser closes, wipes accumulated profiles.
- Using separate profiles, for example one for work and one for shopping, keeps activities from mixing.
- Private browsing deletes cookies when the window closes, but does not make you invisible to the site you visit.
A concrete example
You visit a recipe website and accept everything. Over the next few days, on a social network and on an online newspaper, you see adverts for kitchen appliances. This is no coincidence: third-party profiling cookies have linked your visit to an identifier shared across several sites. Had you refused at the start, the recipe would have been just as readable and that chain would never have started.
In short
- Cookie rules come from the ePrivacy Directive, national law such as Article 122 of the Italian Privacy Code, and the authorities' guidelines.
- Technical cookies do not need consent; profiling cookies do.
- Closing the banner with the X must count as a refusal; scrolling is not consent.
- Also check the "legitimate interest" tab in preference panels.
- Browser settings complement the choices you make on each site.