EU laws, including GDPR, require affirmative informed consent from users when processing data including certain web cookies. This example policy clearly informs users about cookies generally, how they are sued by the company, applicable laws, how to block cookies, and explicitly lists cookies used by the organization and its policies in that regard.

1. © L. Murphy
Example
Association Cookie Policy
Our websites utilize web cookies and similar technologies for purposes of providing user-
friendly browsing experiences. Cookies can also be used for analytics that measure how users
interact with a website’s content. The Association’s policy is to only use cookies with
permission from users of its websites in accordance with the law.
Web cookies are small pieces of data generated by websites that serve as reminders of
important pieces of information. Unless a user takes steps to block cookies, a user’s browser
automatically downloads cookies to the user’s computer during the user’s interactions with
web pages. The user's computer stores the cookies via the web browser. Websites can read a
user’s cookies and use that data for a variety of purposes such as authentication,
personalization, and record keeping.
Blocking or declining to consent to the use of cookies may protect a person’s privacy and
prevent unwanted tracking or profiling. However, if a web page depends on cookies to deliver
content and a user blocks or does not agree to the use of cookies, web content may not be
available or may not function optimally.
The Association seeks to avoid using cookies without express consent of users as required by
law. This cookie policy provides clear and comprehensive information about the cookies that
the Association uses and the purposes for using them.
This policy is dated May 25, 2018.
Legal Requirements
European Union’s Directive on Privacy and Electronic Communications.
The European Union (EU) regulates the use of cookies and similar technologies by way of
directives and regulations. The EU requires websites to secure express consent of users, in
most circumstances, before using cookies.
“[T]he storing of information, or the gaining of access to information already stored, in the
terminal equipment of a subscriber or user is only allowed on condition that the subscriber or
user concerned has given his or her consent, having been provided with clear and
comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the
purposes of the processing.” Directive 2009/136/EC (see page 30)(accessed 4/3/2018).
The directive’s scope provisions do not make it clear that the directive applies to websites
operated both outside the EU and primarily for audiences outside the EU. Some experts
theorize that EU member laws adopted to fulfill the directive can potentially be enforced
against U.S. companies in situations where EU citizens visit U.S. websites; however, no case
law on this matter was located as of April 3, 2018.

2. © L. Murphy
European Union’s General Data Protection Regulations (GDPR)
The EU also regulates the use of cookies by way of the GDPR, effective May 25, 2018. The
Articles of the GDPR, which establish the enforceable legal requirements, do not expressly
mention cookies. However, mention is made in the Recitals, which may be used to interpret
the Articles. According to the Recitals, the GDPR regulates information concerning an
identifiable person. (Recital 26, GDPR.) “Natural persons may be associated with . . . cookie
identifiers . . . which . . . when combined with unique identifiers and other information
received by the servers, may be used to create profiles of the natural persons and identify
them.” (Recital 30, GDPR.) Therefore, the GDPR likely applies to information in certain
cookies. The GDPR requires, in most instances, explicit and knowing consent from users in
order to process such data. (See Art. 6, para. (1) a), GDPR; and Art. 7, GDPR.)
The purported scope of GDPR extends to sites collecting information from EU citizens even
where operating outside the EU. (Art. 3, GDPR.) Under the GDPR, one of the lawful basis to
collect a person’s data is clear affirmative consent. (Art. 6 (1) a), GDPR.)
Cookie Types
Depending on the source of a cookie, cookies can be categorized as either 'first' or 'third' party
cookies.
First-party
First-party cookie means a cookie set by the website being visited by the user. For a user
visiting an Association website, first-party cookies are those placed by the Association.
Third-party
Third-party cookies are cookies placed by a domain or web provider other than the one being
visited by the user. If a user visits a website and a separate company sets a cookie through
that website this would be a third-party cookie.
For example, if a web page features content from external websites, such as banner
advertisements, that might be facilitated by third-party cookies. These cookies can be
associated with tracking a user's browsing history and can be used by advertisers to target
their marketing.
Browsers contain settings to block only third-party cookies.
Cookie Duration
Cookies have differing life spans. Some cookies merely last the duration of a web session and
are then discarded. Those are session cookies. Other cookies are referred to as persistent
cookies and extend beyond the session. Those cookies can expire, for example, in 30 seconds,
30 minutes, 30 days, or even 30 years later, depending on the programming.

3. © L. Murphy
How to delete and block Association cookies
Your web browser, such as Google Chrome, allows you to block cookies through the “settings”
features. For example, when viewing a page on Google Chrome, if you click on the word,
“secure” in the address bar, site information, including cookies, is displayed. By clicking
cookies, you are given options to delete and block cookies of your choosing.
If you use your browser settings to block all cookies on the Association web pages, you may
not be able to access the Association’s web pages beyond the cover page.
Changing your cookie settings
For information on changing cookie settings for commonly used browsers, please see the
following: Chrome, Internet Explorer, Firefox, and Safari.
Can I withdraw my consent?
Yes. You may, at any time, withdraw the consent you gave to permit the use of cookies. You
may go to the profile section of the Association website and click the selection to withdraw
consent for cookies; note, you will be logged out of the site. You should also delete and block
cookies from the Association website using your internet browser settings. Methods for
deleting and blocking cookies are described in this document, and instructions for blocking
and deleting cookies are freely available on the internet. Finally, you should discontinue using
the Association website to prevent renewing cookie life spans or adding new cookies. If you
require further help or confirmation, please contact ________________ at _______________.
Your consent
A request that you consent to accept cookies from the Association websites appears when you
initially seek to log into the site and at periodic times thereafter.
In situations where affirmative consent is not necessarily required by law, your continuing use
of an Association website indicates that you are implicitly agreeing to the placement of
permissible cookies on your computer. If you do not wish to implicitly accept use of any
cookies in connection with your use of this website, you should stop using the Association
websites.
The Association’s Cookie List
First party cookies
(Cookie name, duration, description including purpose and source)

4. © L. Murphy
Third-party cookies
(Cookie name, duration, description including purpose and source)

5. © L. Murphy
Google Analytics
A portion of the Association’s web presence may include pages using Google Analytics. For
more information about Google analytic cookies, please see Google's help pages and privacy
policy.
• Google's Privacy Policy
• Google Analytics Help pages
Google provides options for opting out of their analytics. If you want to opt out of Google
Analytics, you can download and install the add-on for your web browser here.
Additional Information
For further information about this policy, please contact __________________.
To review the privacy policy that apply to users of the Associations websites, please read our
Privacy Policy (hyperlink).
------------------------------
Caveat: This Example Association Cookie Policy is provided for informational purposes only.
The document is not offered as legal advice and should not be taken as an offer of
representation. Laws regarding internet privacy are evolving. Consulting legal experts
knowledgeable in such matters is recommended when adopting policies and procedures
necessary to protect rights and comply with the law.
------------------------------