Article 5( 3 ) of the Privacy and Electronic Communications Directive states only that consent must be given before companies are allowed to place cookies on a web user’s computer or retrieve cookie information already stored there, which has given rise to fears that individual consent may be needed every time a cookie is used.

For online advertisers, such rules could make ad tracking, targeting and audience segmentation – all of which rely on cookies – increasingly difficult or almost impossible.

IAB Europe this week sought to dismiss those fears. In a statement, the trade association said: “For cookies, the legislation’s preamble specifically says that the control settings in a web browser such as Firefox, Internet Explorer, Chrome, Opera or Safari are sufficient to comply with the consent requirement in the legislation.”

Effectively, the EU has “kept the existing opt-out regime for cookies” while giving companies “a solid legal basis to rely on the browser settings when deploying cookies”, says IAB Europe.

Others are not so sure. Pinsent Masons lawyer Struan Robertson told the law firm’s Out-Law blog that the trade body’s interpretation was “optimistic”. Robertson pointed out that a reference to browser settings as a form of consent was contained in a rejected version of Article 5( 3 ). That reference has been “relegated to a recital [the preamble]”, he said, “and recitals matter less than Articles”.

The Privacy and Electronic Communications Directive was approved as part of a package of telecoms reforms. EU member states have 18 months to transpose the directive into national laws.