Cookies
Cookies are small text files placed on a user's device by a website or application to store information such as session identifiers, preferences or tracking identifiers. The term is used more broadly to cover similar technologies such as pixels, local storage, SDK identifiers in mobile apps and device fingerprinting.
Under Art. 5(3) of the ePrivacy Directive (2002/58/EC, as amended), storing or accessing information on a user's device requires prior informed consent, unless the operation is strictly necessary to provide a service explicitly requested by the user (for example, a shopping basket or authentication cookie) or is used solely for transmitting a communication. Where cookies process personal data, the GDPR applies in parallel, and consent must meet the Art. 7 standard: freely given, specific, informed, unambiguous and as easy to withdraw as to give. Cookie walls and pre-ticked boxes are not valid, and national authorities such as the CNIL have issued substantial fines for non-compliant banners.
For life sciences companies the stakes are higher than for most websites: patient-facing apps, disease awareness sites and trial recruitment pages can reveal a user's health condition through analytics or advertising identifiers, turning ordinary tracking into processing of health data. Cookie audits, consent management platforms configured for opt-in, and careful review of third-party tags are therefore part of any HealthTech or pharma compliance programme.
