Luxembourg: The National Commission for Data Protection (CNPD) publishes guidelines on cookies. The guidelines distinguish between essential cookies, for which there is no obligation to obtain consent, and cookies that are not necessary for the correct display of the website, for which there is an obligation to obtain consent. The CNPD provides specific examples to support this analysis. In addition, the guidelines provide many examples of good practice in the use of cookies.
CNPD indicates that consent is not required when cookies are used for:
- recording the user’s cookie choices,
- authenticate the user, provided that the cookie is used exclusively for this purpose,
- saving your shopping basket,
- save the data you enter on contact forms,
- streaming of content,
- customisation of services, e.g. saving display or language settings,
- security, also provided that the cookie is only used for this purpose; and
- analysis, subject to the following explanations.
The CNPD points out that although analytical cookies do not pose a significant privacy risk, it is nevertheless necessary for the website operator to obtain the user’s consent before placing such a cookie.
The CNPD added, however, that in the case where the website operator is able to demonstrate that the use of analytical cookies is necessary to provide the service (for example, to assess server performance), such cookies may be exempted from the consent requirement, provided that:
- they are not transferred to third parties or combined with other data,
- they do not allow for the global monitoring of a person’s navigation when using different applications or browsing several websites, and
- they are collected solely by and for the use of the website administrator and are used only to create anonymous statistics.