1. Meaning and scope of web tracking disclosures

Web tracking disclosure adequacy refers to whether a website, mobile application, or online service sufficiently informs users about the collection, observation, analysis, sharing, and use of their online activities through tracking technologies.

These technologies may include:

Cookies, including advertising and analytics cookies.

Tracking pixels, web beacons, and invisible image requests.

Browser fingerprinting and device identification.

Advertising identifiers and cross-site tracking.

Session replay, mouse movement tracking, and keystroke monitoring.

Social-media plug-ins and third-party analytics scripts.

Location tracking, behavioural profiling, and automated personalisation.

The central legal question is whether the information provided to users is clear, accurate, sufficiently specific, accessible, and consistent with the website's actual tracking practices.

A website may have a privacy policy and still provide inadequate disclosure. For example, a statement that “we use cookies to improve your experience” may not adequately explain that third-party advertising companies track users across multiple websites, create behavioural profiles, or share identifiers with other organisations.

Adequacy is not merely a question of whether a notice exists. It concerns whether users receive meaningful information and, where required, a genuine opportunity to consent or refuse.

2. Applicable legal framework

The legal standard depends on the jurisdiction, the type of information collected, the purpose of tracking, and whether the tracking is necessary for the requested service.

A. Transparency and meaningful notice

Under GDPR Articles 5 and 12–14, applicable processing information must be communicated transparently and in an intelligible, accessible form. Article 13 addresses information that must be supplied when personal data is collected directly from the individual.

Where relevant, disclosures should explain:

The identity of the organisation responsible for processing.

The categories of personal data collected.

The purposes of tracking and the applicable legal basis.

The recipients or categories of recipients.

Retention periods or the criteria used to determine them.

Relevant user rights and how to exercise them.

International transfers, where applicable.

Profiling or automated decision-making where the relevant legal requirements apply.

Not every technical detail must necessarily appear in the first cookie banner. A layered disclosure can be appropriate, provided the essential information is accessible before the relevant decision and the additional detail is easy to locate.

B. Cookie consent and device access

Under Article 5(3) of the EU ePrivacy Directive, storing information on or accessing information from a user's terminal equipment generally requires informed consent, unless a statutory exception applies, such as where the operation is strictly necessary to transmit a communication or provide a service explicitly requested by the user.

This requirement is distinct from the GDPR legal basis for processing personal data. A website may need to satisfy both regimes.

Consequently, a privacy policy that mentions cookies does not automatically authorise non-essential tracking. Nor does a user's continued browsing necessarily constitute valid consent.

C. Indian legal context

In India, the Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data, including requirements concerning notice, consent, specified purposes, and data-principal rights, subject to the provisions in force and applicable rules.

Its precise application must be assessed against the relevant commencement notifications, rules, processing circumstances, and statutory exceptions. The Act should not be treated as automatically imposing the EU's specific cookie-banner requirements.

Organisations operating in India may also need to assess applicable provisions of the Information Technology Act, 2000, associated rules, contractual commitments, consumer-protection requirements, and the laws of other jurisdictions where their websites operate.

3. Essential tests for determining disclosure adequacy

A court or regulator assessing web tracking disclosures will commonly examine the following factors.

1. Clarity and accessibility

Disclosures should use understandable language, avoid unexplained technical terminology, and be available before the relevant consent decision where required. A lengthy privacy policy hidden behind several menus may not adequately communicate important tracking practices.

2. Specificity of purpose

The organisation should distinguish necessary operations from analytics, advertising, personalisation, fraud prevention, and cross-site profiling. Broad statements such as “business purposes” may be insufficient where more specific information is required.

3. Third-party disclosure

Where applicable, users should be informed about third-party recipients or recipient categories, including advertising networks, analytics providers, data brokers, and social-media platforms. Outsourcing tracking does not automatically eliminate the website operator's legal responsibilities.

4. Valid consent and user choice

Where consent is required, the user must make an appropriate affirmative choice. Rejecting non-essential tracking should be effective, and consent should not be inferred merely from silence, inactivity, or continued browsing.

5. Retention and tracking duration

Disclosures should explain applicable retention periods or the criteria for determining them. Cookie lifetimes, identifiers that persist across sessions, and retention of derived profiles should be considered separately where relevant.

6. Accuracy and implementation

The notice must match actual technical behaviour. If a website promises that advertising tracking is disabled until consent, but scripts send personal data before consent, the disclosure and implementation may both be deficient.

4. Important judicial decisions — at least eight case laws

The following cases establish significant principles concerning cookies, online identifiers, third-party tracking, transparency, consent, and the handling of personal data. They arise from different jurisdictions and should be applied according to the governing law rather than treated as one universal legal test.

Case 1. Planet49 GmbH — C-673/17 (2019)

Court: Court of Justice of the European Union (CJEU).

Facts: An online promotional lottery used a pre-selected checkbox to obtain permission for cookies associated with evaluating users' browsing behaviour on advertising partners' websites.

Legal issue: Whether a pre-ticked checkbox constituted valid consent and what information users had to receive about cookies.

Decision and principle: The Court held that a pre-ticked checkbox did not constitute valid consent. It also held that the information provided to users must include the duration of cookie operation and whether third parties could access the cookies. The consent requirement applied to storing or accessing information on terminal equipment even when that information was not necessarily personal data.

EUR-Lex

+1

Relevance to disclosure adequacy: This is a leading authority for the proposition that disclosure must be meaningful and that consent cannot be presumed from inactivity. Cookie notices should address duration and third-party access rather than merely state that cookies are used.

Practical lesson: A compliant design should provide a genuine choice, explain the material purposes of tracking, and make relevant cookie information accessible before consent.

Case 2. Fashion ID GmbH & Co. KG — C-40/17 (2019)

Court: CJEU.

Facts: An online clothing retailer embedded Facebook's “Like” plug-in on its website. The embedded technology could transmit visitor information to Facebook when the page was loaded.

Legal issue: Whether a website operator could be responsible for personal-data collection and transmission performed through an embedded third-party plug-in.

Decision and principle: The Court held that a website operator could be a joint controller with the plug-in provider for the collection and transmission of personal data where the operator participated in determining the purposes and means of those operations. That responsibility did not automatically extend to subsequent processing over which the operator had no influence.

Relevance to disclosure adequacy: Website owners cannot assume that tracking is exclusively the third party's responsibility merely because the technology is supplied by another company. Where the operator is a controller, appropriate information and a lawful basis must be established for the relevant processing.

ConsentStack

Practical lesson: Maintain an inventory of embedded scripts, plug-ins, pixels, and external requests. Assess what data each transmits, when transmission occurs, who receives it, and which party is responsible for each processing operation.

Case 3. Google Spain SL v AEPD — C-131/12 (2014)

Court: CJEU.

Facts: An individual sought relief concerning search results that displayed information about an earlier debt-related notice. The case concerned the role of search engines in processing and presenting personal data.

Legal issue: Whether the operation of a search engine constituted processing of personal data and when individuals could seek removal of links to information about them.

Decision and principle: The Court held that a search engine's activities could constitute processing of personal data and recognised, under the applicable legal framework, a right to request de-listing in certain circumstances.

Relevance to disclosure adequacy: Although not a cookie-consent decision, it illustrates that online systems can process personal data through indexing, aggregation, and presentation, even where the underlying information originated elsewhere. Tracking disclosures must be assessed against the actual processing activities and their purposes, not merely the website's description of its own content.

Practical lesson: Identify whether online identifiers and browsing information are combined with other information to construct profiles, identify individuals, or influence search results and personalisation.

Case 4. Breyer v Bundesrepublik Deutschland — C-582/14 (2016)

Court: CJEU.

Facts: The dispute concerned dynamic IP addresses recorded by website operators and whether those addresses could constitute personal data for the website operator.

Legal issue: Whether an IP address could be personal data even where the operator did not itself possess all the information necessary to identify the user.

Decision and principle: The Court held that a dynamic IP address could constitute personal data for a website operator where the operator had legal means reasonably likely to be used to obtain identifying information from the internet service provider.

Relevance to disclosure adequacy: Organisations should not automatically classify IP addresses, cookie identifiers, or device identifiers as anonymous simply because they do not directly display a person's name.

Practical lesson: Examine whether identifiers can reasonably be linked with other records to single out or identify a person. This assessment influences the transparency, lawful-basis, security, and retention obligations that apply.

ConsentStack

Case 5. Orange România SA — C-61/19 (2020)

Court: CJEU.

Facts: A telecommunications provider collected customer documents containing a statement concerning consent to the copying and retention of identity documents. The case examined whether the consent had been validly obtained.

Legal issue: Whether consent could be inferred from contractual documentation and whether the controller had to demonstrate that consent was freely given, specific, informed, and unambiguous.

Decision and principle: The Court emphasised that a controller bears responsibility for demonstrating valid consent. A pre-formulated contractual statement or a signature on documentation does not automatically prove that the individual made a valid, informed choice.

Relevance to disclosure adequacy: This reasoning is relevant when consent for online tracking is bundled into general terms, presented as a default setting, or recorded without reliable evidence of the user's choice.

Practical lesson: Retain appropriate records of consent, including the relevant notice version, purposes presented, choices made, and the time and method of the decision. Evidence of a click alone may not establish that the consent was adequately informed.

Case 6. Meta Platforms Inc. v Bundeskartellamt — C-252/21 (2023)

Court: CJEU.

Facts: The German competition authority examined Meta's combination of data collected through Facebook, other Meta services, and external websites or applications.

Legal issue: How data-protection rules apply when a platform combines personal data from different sources and relies on consent or other legal bases for processing.

Decision and principle: The Court addressed the legal conditions for processing and combining personal data across services. It explained that a dominant market position does not, by itself, make consent invalid, but it is an important circumstance when assessing whether consent was freely given. It also considered the application of other GDPR legal bases and the requirement that processing satisfy the relevant conditions.

Relevance to disclosure adequacy: A notice that mentions only activity on the platform may be insufficient if the service also combines off-platform browsing information, advertising data, and information from other services.

Practical lesson: Explain cross-service data combination, profiling purposes, and relevant recipients or recipient categories. Assess whether the chosen legal basis genuinely covers each processing operation.

ConsentStack

Case 7. IAB Europe — C-604/22 (2024)

Court: CJEU.

Facts: The case concerned the Transparency and Consent Framework used in the online advertising ecosystem to record and communicate users' preferences through a consent string.

Legal issue: Whether information encoded in a consent string could constitute personal data and whether an industry organisation could qualify as a joint controller for relevant processing.

Decision and principle: The Court held that a consent string recording individual preferences could constitute personal data where it could be associated with an identifier, such as an IP address. It also addressed the circumstances in which IAB Europe could be considered a joint controller for the creation and use of the framework's consent signals, without automatically making it responsible for all subsequent processing by participating organisations.

Relevance to disclosure adequacy: Technical consent signals are not necessarily anonymous merely because they consist of codes rather than readable names. Nor does participation in a standardised consent framework, by itself, prove that every organisation's disclosures and tracking practices comply with the law.

Practical lesson: Ensure consent-management systems accurately communicate choices to downstream vendors, and verify that actual tracking respects those choices.

ConsentStack

Case 8. Google Inc. — Federal Trade Commission Safari tracking settlement (2012)

Authority: United States Federal Trade Commission (FTC) enforcement proceeding.

Facts: The FTC alleged that Google represented to Safari users that particular browser settings would effectively prevent certain advertising tracking, while Google circumvented the browser's default blocking mechanism to place tracking cookies.

Legal issue: Whether privacy representations that conflict with actual tracking practices can amount to deceptive conduct and violate an existing FTC order.

Outcome: Google agreed to pay a civil penalty of $22.5 million to settle the FTC charges. The settlement required Google to disable the relevant tracking cookies. This was a regulatory settlement, not a judicial finding after a contested trial on all allegations.

Federal Trade Commission

Relevance to disclosure adequacy: An organisation can face enforcement risk not only because a notice omits information, but also because a specific promise about tracking, browser settings, or opting out is false in practice.

Practical lesson: Test tracking behaviour across browsers and devices. Confirm that opt-out mechanisms, privacy settings, and statements about blocking tracking operate as advertised.

5. Additional case law: Wirtschaftsakademie Schleswig-Holstein — C-210/16 (2018)

Court: Court of Justice of the European Union.

Facts: A company operated a Facebook fan page and received aggregated visitor statistics generated by Facebook through tracking technologies.

Legal issue: Whether the administrator of a fan page could share responsibility for processing visitor data when Facebook controlled the underlying technical platform.

Decision and principle: The Court held that the fan-page administrator could be a joint controller in relation to the processing involved in generating the visitor statistics. Joint controllership did not require each party to have equal influence over the processing.

Relevance: A website or online service may share responsibility for tracking-related processing even when a third-party platform determines much of the technical implementation.

Practical lesson: Disclosures should accurately explain relevant third-party analytics and identify the responsible parties in accordance with the applicable transparency requirements.

6. Comparative analysis of the principal cases

These authorities collectively demonstrate that disclosure adequacy involves three distinct questions: what users are told, whether the legal conditions for processing are satisfied, and whether the actual technical system follows those disclosures and choices.

7. Common failures that make web tracking disclosures inadequate

A. Generic or misleading language

A statement such as “we use cookies to improve your experience” may not sufficiently explain cross-site advertising, profiling, data sharing, or other material purposes.

Improvement: Identify each significant tracking purpose separately and explain the types of information involved.

B. Concealed third-party tracking

A website may disclose its own analytics but omit advertising partners or third-party scripts that transmit information when pages load.

Improvement: Maintain a vendor and tracker inventory, identify relevant recipient categories, and ensure the disclosure matches actual data flows.

C. Invalid consent mechanisms

Examples include pre-ticked boxes, consent inferred from continued browsing, or interfaces that make refusal unnecessarily difficult.

Improvement: Where consent is legally required, provide an affirmative choice, a functional rejection option, and a means to withdraw consent.

D. Tracking before consent

A website might display a consent banner while advertising pixels or analytics scripts have already transmitted information.

Improvement: Test actual network requests and cookie storage before and after each consent choice. Prevent non-essential tracking that requires prior consent until the required consent has been obtained.

E. Excessive retention

Persistent identifiers and behavioural profiles may remain in use much longer than users reasonably understand from the disclosure.

Improvement: Establish documented retention periods or criteria, periodically review them, and distinguish cookie expiration from the retention of server-side records.

F. Inadequate disclosure of profiling

Users may be told that data is collected for “personalisation” without being informed of materially different uses, such as targeted advertising or significant automated decisions.

Improvement: Explain profiling purposes clearly and provide additional information where required by the applicable law.

8. Compliance framework for businesses

Organisations can use the following checklist to evaluate their disclosures.

Tracking disclosure audit

0/7 complete

Tracking inventory

Identify cookies, pixels, SDKs, fingerprinting techniques, analytics scripts and third-party requests.

Purpose and legal basis

Document the purpose and applicable legal basis for each processing operation.

Disclosure quality

Explain data categories, purposes, recipients, retention and applicable user rights.

Consent interface

Provide meaningful accept and reject choices wherever prior consent is required.

Technical validation

Test whether trackers operate before consent and whether rejection and withdrawal work.

Vendor governance

Review third-party contracts, responsibilities, data transfers and onward disclosures.

Evidence and review

Keep appropriate consent records, policy versions, test results and periodic compliance reviews.

Copy audit checklist

9. Potential legal consequences

Inadequate disclosures can expose an organisation to several types of legal and commercial risk, depending on the applicable jurisdiction and the facts.

Regulatory enforcement: Orders to change notices, stop unlawful tracking, delete unlawfully collected data, or implement corrective measures.

Financial penalties: Administrative fines or civil penalties where the governing law authorises them.

Consumer-protection proceedings: Action over misleading statements, hidden practices, or ineffective opt-out promises.

Civil claims: Potential compensation claims where the statutory requirements for standing, causation, harm, and remedies are met.

Contractual disputes: Disputes with advertisers, analytics providers, business partners, or customers over data use and privacy commitments.

Reputational damage: Loss of user confidence and increased scrutiny from regulators, business partners, and customers.

Not every inadequate notice automatically produces liability. The legal outcome depends on the specific statutory duty, the nature of the violation, applicable defences or exceptions, and the available remedy.

10. Recommended drafting standard

A strong web tracking disclosure should answer, in plain language:

What information is collected?

Which tracking technologies collect it?

Why is the information collected?

Is it linked to an identifiable person or combined with other data?

Which third parties receive it, or what recipient categories are involved?

How long is the information retained?

What legal basis applies?

What choices and rights are available?

How can users withdraw consent or change their preferences?

Does the actual tracking system respect those choices?

For example, instead of saying only “we use cookies to improve our services,” a more informative disclosure might explain that the website uses necessary cookies for core functions, analytics technologies to measure site usage, and advertising technologies to measure campaigns or personalise advertisements. It should then explain applicable third-party sharing, retention, user choices, and the legal basis for each relevant activity.

That example is a drafting starting point, not a complete notice: the final wording must reflect the organisation's real practices and applicable law.

Conclusion

Web tracking disclosure adequacy is a substantive compliance obligation, not simply a document-formatting exercise. The strongest legal authorities show that users must receive meaningful information, consent must meet the applicable legal standard, identifiers may remain personal data even without a visible name, and website operators may be responsible for third-party tracking technologies.

For an organisation operating internationally, the most defensible approach is to combine clear, layered disclosures with a verified technical inventory, effective consent management, appropriate vendor governance, and regular testing of actual data flows.

Jurisdictional qualification: These cases are principally European Union and United States authorities. They provide useful comparative guidance but do not automatically determine the outcome under Indian law. An India-specific opinion should separately assess the provisions in force under the Digital Personal Data Protection Act, 2023, applicable rules and commencement notifications, and any other relevant Indian legislation.