Fines for cookies in Slovakia: what really threatens e-shops

People often use fines to scare you about cookies. The reality is more practical: most companies do not need panic, but order. They need to know which cookies they use, why they use them, when they fire and how they can prove consent.

An e-shop that uses marketing and analytics scripts is at greater risk than a simple informational website. Not because an e-shop is automatically a problem, but because it typically uses more third parties: Google Ads, Meta Pixel, price comparison sites, affiliate networks, e-mailing, chats, heatmaps and personalization.

When risk arises

Risk arises mainly when a website:

• fires marketing cookies before consent,
• does not offer the option to reject optional cookies as easily as to accept them,
• uses pre-ticked consents,
• does not list third parties,
• does not have an up-to-date cookie declaration,
• cannot prove who granted or withdrew consent and when,
• states something in its policy that differs from what happens on the website,
• has not resolved the withdrawal of consent.

During an inspection the text alone is not what matters. The technical behavior of the website matters too.

GDPR vs ePrivacy

With cookies, two regimes come into play.

ePrivacy rules govern storing information on a terminal device or accessing it. That is typically the storing of the cookie itself in the browser. In the EU the principle applies that no consent is needed for necessary cookies, but for optional cookies you usually do need it.

GDPR applies when you process personal data through cookies. With analytics, marketing, advertising identifiers or profiling this is very often relevant.

That is why it is not enough to say "we have a cookie bar". You need to know which legal basis you use and whether the technology fires at the right time.

What the authority can inspect

A supervisory authority or a legal auditor may look at:

• the text of the cookie bar,
• the availability of a reject button,
• the list of cookies,
• third parties,
• the retention period,
• proof of consent,
• the technical firing of scripts,
• the way consent can be withdrawn,
• the match between the policy and the actual website.

The worst combination is a nice cookie policy that does not correspond to what happens on the website.

How high the fine can be

GDPR provides for high maximum fines, but in practice the specific situation is always assessed: the nature of the breach, its scope, duration, the number of affected individuals, cooperation, corrective steps and other circumstances.

For a regular e-shop it is therefore more sensible to think practically:

• can I show which cookies I use?
• can I show that marketing cookies do not run before consent?
• can I show consent records?
• can a visitor easily withdraw consent?
• is my cookie declaration up to date?

If you can answer yes to these questions, the risk is significantly lower.

What to fix first

If you have little time, start with this order:

1. Run a cookie scan.
2. Split cookies into necessary, analytics, functional and marketing.
3. Block optional scripts before consent.
4. Add a "Reject all" button.
5. Enable changing and withdrawing consent.
6. Add the retention period for cookies and consent records.
7. Turn on a regular rescan.

These are the things that directly improve the actual state of the website.

How Cookienovo helps

Cookienovo helps you mainly with demonstrability and the technical part:

• it scans cookies,
• it generates a cookie declaration,
• it manages consents,
• it stores consent records,
• it enables export for an audit,
• it supports the withdrawal of consent,
• it blocks optional scripts,
• it integrates Google Consent Mode v2.

That does not mean you do not need legal texts. It means the legal texts have something to stand on.

Conclusion

Fines are not the main reason to have a cookie bar in order. The main reason is trust and control over your own website.

If you know which cookies you use, why you use them and you can prove consent, you are in a much better position than a website that just copied cookie text from the internet.

Check your website in Cookienovo and find out whether your cookie bar matches reality.

Recommended sources:

• GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• ePrivacy Directive: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058
• EDPB Guidelines 05/2020 on consent: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf

---