Italian legislation has integrated the European Community 2009/136/CE regulation into its own law, which obliges website managers that use cookies or other tracking technologies to inform the user about the types of cookies used on the site.

This Provision issued by the Italian Data Protection Authority (Garante) for the protection of personal data no. 229 of the 8th May 2014, published in G.U. (Gazzetta Ufficiale) no. 126 of the 3rd of June 2014, categorises cookies into two categories: “technical” cookies and “targeting” cookies.

Technical cookies

Technical cookies are used solely for the “transmission of information via an electronic communication network, or those strictly necessary for the service supplier of the company to share information that has been explicitly requested by the subscriber or user to provide said service.

They are not used for any other purpose and they are usually installed directly by the owner or manager of the website. They can be divided into navigation or session cookies, which ensure smooth navigation and use of the website (e.g. allowing the user to make a purchase or authenticate their details to access a personal profile); cookie analytics, similar to technical cookies, when they are used directly by the website manager to gather aggregate information on the number of users and how visitors use the website; functional cookies that help the website owner personalise the user’s browsing experience (e.g. language, product selected for purchase) to improve the service offered to the same.

The installation of these cookies does not require the user’s consent.

Targeting cookies.

Targeting cookies are used to create user profiles and send targeted advertising messages, in line with the preferences of the user while navigating the web. Due to the potentially invasive nature of these cookies in terms of user privacy, European and Italian law foresees that the user must be adequately informed on the use of the same and must express their valid consent.

In the Provision in question, Data Protection law also categorises cookies according to the subject that operates as the personal data owner of the collected cookies, distinguishing between first-party and third-party cookies.

1. First-party cookies.

First-party cookies are managed by the owner of the website. In this case, the obligation to inform the user is the duty of the website owner. The latter is also obliged to inform users on how they can block these cookies.

2. Third-party cookies.

Third-party cookies are managed by a third-party service that is not the owner of the website. In this case, the obligation to inform the user and provide them with information on how to block these cookies, is the duty of the third-party provider, whereas the owner of the website is obliged to publish the link of the third-party provider on their website, where said information is available.

In the case of both types of cookies (first-party or third-party), consent, obligatory when using targeting cookies, occurs via a special banner, published on the home page of the website.