When are cookies considered technically necessary?
ANSWER
Neither Directive 2002/58/EC nor the Telecommunications Law contains a detailed list of what should be understood as "technically necessary cookies." However, Opinion 04/2012 of the Article 29 Working Party on the Cookie Consent Exemption (WP 194) provides criteria for assessing whether cookies referred to in Article 5(3) of Directive 2002/58/EC are technically necessary.
According to the Austrian supervisory authority, the following functions are considered technically necessary (and therefore the corresponding cookies may be set without obtaining consent):
- essential session management (e.g., cookies used to store the contents of a shopping cart in an online store or cookies used to maintain a user's logged-in status);
- data entered into an online form, where submission of the form requires entering information across multiple pages of a website;
- information regarding consent status, provided that no unique online identifier is assigned for this purpose.
From a technical perspective, cookies that track user behavior on one or more websites are not considered necessary (and therefore require consent). This applies in particular to social media plugins and advertising networks, where the use of such cookies involves transferring website visitors' data to third parties.
The concept of "necessity" should not be interpreted as being equivalent to "economic necessity." This means that marketing cookies used to display personalized advertisements do not become technically necessary merely because personalized advertising is required to finance a website (see the judgment of the Austrian Federal Administrative Court, Case No. GZ: W214 2223400).
