The European Data Protection Board (EDPB) opposes ‘cookie walls’, the practice whereby a user can only access content if he or she has agreed to be tracked. In its new guidelines published on Wednesday 6 May, it also considers that scrolling does not correspond to the notion of active consent provided for in the General Regulation.
These guidelines are an update of the document adopted by the Article 29 Working Party (the predecessor of the EDPB) in April 2018, a few weeks before the implementation of the General Data Protection Regulation.
As a reminder, the General Data Protection Regulation (2016/679) imposes detailed requirements on companies and organisations with regard to the collection, storage and management of personal data. Consent is one of the six legal bases for the processing of personal data, as listed in Article 6 of the Regulation (known as the GDPR). Such consent must be free, specific, informed and unambiguous, and must be requested in clear and simple terms.
And this is what the EDPB recalls in his update of the 2018 document. It looks at two particular situations. The first concerns the validity of consent in the case of a cookie wall. In this regard, the EDPB states that “for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls)”.
The second situation relates to scrolling and consent. Here, the independent European body invokes Recital 32 of the GDPR to conclude that “actions such as scrolling or swiping through a webpage or similar user activity will not under any circumstances satisfy the requirement of a clear and affirmative action”. In its view, it is indeed very difficult to determine whether or not unambiguous consent was obtained from these actions. In addition, it is also difficult to provide a way for the user to withdraw consent in a manner that is as easy (as at the time of granting it).
It should be noted that, according to the European Commission’s provisional timetable dated 5 May, the European Commission intends to present its report on the implementation and review of the GDPR on 3 June (see EUROPE 12459/24).
See the report: https://bit.ly/2zh1zEW (Original version in French by Sophie Petitjean)