Editors and “Third Parties”

Another aspect to consider for purposes of a correct definition of the matter under discussion, is the subjective aspect. Therefore,  we must take into account of the different entity that installs the cookies on the user’s terminal, depending on whether it is the website operator of the user visiting the website (which can be specified in short as the “editor”) or a different website that installs cookies through the former (so-called “third parties”).

On the basis of the findings of the public consultation, it is considered necessary for said distinction between the two entities mentioned above to be taken into account for purposes of correctly identifying the respective roles and the respective duties with reference to issuing the information notice and acquiring the consent from users online.

There are multiple reasons for which it is not possible to assign the editor the obligation to provide the informative notice and acquire the consent to install the cookies for its website, even for those installed by “third parties”.
First of all, the editor must always have instruments and legal and economic resources to fulfil the obligations of third parties and must therefore be able to ensure the consistency of what is declared by third parties and the purposes that are actually pursued with the use of the cookies every time. It is very difficult given the fact that the editor often does not personally know all the third parties that install the cookies through its website and therefore not even the logic behind the respective processing. Moreover, it is not rare for persons with the role of concessionaries to come between the editor and third parties and therefore it is very difficult for the editor to monitor the activities of all the involved subjects.

Third party cookies could then be modified by third party suppliers over time and it would not be efficient to ask editors to keep track of these subsequent changes.

We must also take into account the fact that often editors that also include natural persons and small businesses, are the “weakest” part of the relationship. If third parties are normally large companies with substantial economic burden, normally more editors are required and could even be very numerous with respect to a single editor.

It is therefore considered that even with respect to the above reasons, the editor cannot be bound to include on the home page of its website, the information notices regarding the cookies installed to use through third parties. Furthermore, this would result in a general lack of clarity of the information notice issued by the editor and at the same time make it extremely difficult for the user to read the document and thus understand the information contained therein and in this way losing the simplification purpose envisaged in article 122 of the Code.

Likewise, as far as the acquisition of the consent for profiling cookies, as due to the above reasons keeping different the respective positions of editors and third parties, it is necessary to consider that the editors with which users will establish a direct relationship by accessing the respective website, must assume a dual role.

In fact, from one part said persons are data controllers as the cookies directly installed from their website; on the other part, as there cannot be a joint ownership with third parties for cookies that they install through themselves, it is correct to consider them as a sort of technical intermediaries between them and the users. Therefore, it is in this role that as you can see hereafter, they are called to take part in this resolution with reference to issuing the information notice and acquiring the consent from users online with respect to third party cookies.