Mark Pestronk
Q: When I browse the Internet, the start pages of many websites have small, annoying windows about cookies. Naturally, I want to get rid of the window as fast as I can, so I usually just hit "accept" to make the window disappear. Do I need a window like that on our own travel agency's website? If so, what does the window have to say? Is the window a federal requirement, a state requirement, or a trade group requirement like PCI compliance? What about accepting or declining specific kinds of cookies, such as those enabling targeted advertising?
A: A cookie is a small text file that a website places on a visitor's device so the site can recognize that visitor on return trips or clicks to another page on the site. If your agency's site doesn't place cookies, you don't need any cookie notice at all.
Contrary to popular belief, no federal or state law or industry rule requires you to obtain a user's "Accept" before placing cookies. If you've ever had to click "Accept," the website was probably imitating European practice, which does require opt-in consent, or its designer didn't understand U.S. law.
More than 20 states now have comprehensive privacy statutes covering cookies. These generally let residents opt out of cookies tied to specific practices -- sale of data, targeted advertising and profiling -- but don't give a right to opt out of cookies altogether. A cookie that just keeps the booking flow working isn't covered by any opt-out right.
The state statutes generally require opt-in consent for specific cookie types in narrower cases, such as when that cookie collects sensitive data like precise geolocation, citizenship or immigration status. So if you collect such information in an online frequent-traveler profile or sell travel insurance online, for example, you may need the user to opt in to cookies for these specific purposes.
Parental opt-in is also needed under both federal and state laws to use cookies to sell (or target ads) to a minor. Most states set the minor's age at 13 and under; California and Colorado require opt-in for children up to 16.
All these state-law opt-out or opt-in rules apply only once your site crosses the state's volume or sales thresholds, which are typically 100,000 residents' data processed annually, though some states go as low as 35,000, or as low as 10,000 paired with a revenue test. Federal law is different; it requires parental consent before collecting data from a child under 13 regardless of your site's traffic or revenue.
These thresholds and the underlying state laws change frequently, so an agency below every threshold today should still get its web designer to monitor its growing website traffic and any new state legislation each year.
Where a notice and an opt-out option are required, the notice should disclose the categories of cookies you use, link to your privacy policy and provide a working opt-out for the covered practices noted above.
The cookie-notice obligation is separate from your privacy policy, which discloses what personal information you collect through the site, regardless of whether you use cookies.