How does the GDPR relate to cookies?

The General Data Protection Regulation (GDPR) applies specifically to the processing of personal data. While the placement of cookies is governed by the Privacy and Electronic Communications Regulations (PECR), the GDPR becomes applicable the moment a cookie processes information that qualifies as personal data. This includes online identifiers such as cookie IDs, IP addresses, or device IDs, which can be used to single out an individual. If a cookie is used solely for functions that do not involve personal data (e.g., storing a non-identifiable language preference), then the specific processing rules of the GDPR would not apply to that data, although PECR's consent rules for placing the cookie still would.

B. The GDPR applies in all cases where cookies are used This is incorrect because GDPR's scope is strictly limited to personal data. A cookie that does not collect or process any personal data falls outside its remit.
C. Where PECR is engaged only PECR will apply to the processing of personal data This is incorrect because PECR and GDPR work concurrently. PECR sets the specific rule for using cookies, while GDPR governs the processing of any personal data collected by them.
D. Websites only need an opt out of cookies if GDPR applies This is incorrect. The requirement for consent (an opt-in for non-essential cookies) is mandated by PECR, which applies to storing any information on a user's device, not just personal data. ---

1. Information Commissioner's Office (ICO). (2019). Guidance on the use of cookies and similar technologies.

Page 8, "How do PECR and the UK GDPR interact?": "PECR and the UK GDPR work together... If you are processing personal data, you will also have to comply with the UK GDPR." This clarifies that GDPR applies when personal data is processed (supporting A) and that PECR and GDPR are not mutually exclusive (refuting C).

Page 6, "What are the rules on cookies and similar technologies?": The guidance states that one of the requirements is to "comply with the UK GDPR requirements if you are processing personal data." This directly supports the correct answer (A).

2. European Data Protection Board (EDPB). (2020). Guidelines 05/2020 on consent under Regulation 2016/679.

Paragraph 17: This document clarifies that the standard of consent required by the ePrivacy Directive (from which PECR is derived) must meet the conditions for valid consent under the GDPR. This demonstrates the interplay between the regulations and refutes the idea that only one applies (refuting C).

3. Court of Justice of the European Union (CJEU). (2019). Judgment in Case C-673/17 Planet49 GmbH.

Paragraphs 63-64: The court ruled that for the purposes of processing personal data using cookies, the requirements of the GDPR must be met. This legally establishes that GDPR's applicability is tied to the processing of personal data via cookies, directly supporting answer A.