privacy terms-of-service european-union consent
EU Cookie Law: can two sites differing by the third level domain can be considered a single website?
<p>Let's make a common example:</p>

<p><code>www.example.com</code> is the main website of a company, then they have</p>

<p><code>blog.example.com</code> that is the company's blog.</p>

<p>It's important to note that the same organization is behind <strong>both websites</strong> and is the unique owner of the first+second level domain name <code>example.com</code>.</p>

<hr>

<p>The "blog" website could have been incorporated into the main website:</p>

<p><code>www.example.com/blog/</code></p>

<p>But this time this is not the case. There are many (valid) reasons to split a site via third-level domain names, as in the example above where the blog site is separated from the main site.</p>

<hr>

<p>Now <strong>the question is: can the two website share the same cookie-consent-banner and the same cookie policy extended disclosure?</strong></p>

<p>And more important (in order to avoid annoying the user): <strong>is it licit that when the user give consent on one web site it implicitly give consent to the other site?</strong></p>

<hr>

<p>Taking the initial example the user go to <code>www.example.com</code>. The banner is displayed and the user give consent accepting the cookie policy.</p>

<p>Then the user see the link <em>"Visit our blog"</em>, navigates to the website's blog landing to <code>blog.example.com</code>.</p>

<p>Is it possibile to avoid displaying a banner again?</p>

<hr>

<p>Provided of course that both the banner and the extended cookie policy are written in the correct way.</p>

<p>An issue highlighted with your question is whether the regulations target technical implementation of a web presence or target the user view of an organization's web presence.</p>

<p>From a technical perspective, a web address is nothing more than an addressing scheme. www.example.com, www2.example.com and example.com could all serve the same content from the same web server. It is not unusual for companies that have been acquired to point their old address, www.oldcompany.com to the acquiring company's, www.newcompany.com. The user, from whom consent is required, will experience one company's presence.</p>

<p>The regulations are designed to force the  explicit consent from a user before certain types of information are stored and accessed on the user's equipment.</p>

<p>From the <a href="https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/" rel="nofollow noreferrer">Information Commissioner's Office</a> (ico), an independent UK authority you will find <a href="https://ico.org.uk/media/for-organisations/documents/1545/cookies_guidance.pdf" rel="nofollow noreferrer">Guidance on the rules on use of cookies and similar technologies</a>. On page 25 you can find,</p>

<blockquote>
  <p><strong>Consent for cookies on more than one site</strong></p>
  
  <p>An organisation with several connected websites could in theory obtain consent
  for cookies set on each site in one place, for example when the user logged in on
  one site. In order for this consent to be valid it would have to be absolutely clear
  which websites the cookies in question were set on, what those cookies were
  used for and exactly what the user was agreeing to.</p>
</blockquote>

<p>As long as the language provided to the user is clear and unambiguous when seeking consent then consent can be granted for multiple "sites," however that word is defined.</p>

<p>Depending on the purpose of the cookies, it may be that the types of cookies that would require consent may only be created for a sub-set of visitors. In such a case it may be desirable to only seek consent from those users who actually need to visit those particular areas of a web site. In this case, the "site" for which consent is required would be a subset of the overall organization's presence on the web.</p>

<p>It is up to the implementor of the site to determine when, where and with what language to get clear consent from the user before storing and accessing the type of data that requires consent. Note from the linked guidance that not all data storage and access requires explicit consent.</p>
