Unfair practices of requiring consent when using cookies - cookie wall and scrolling. GDPR

The European Data Protection Board has pointed out certain unfair practices used to obtain consent to the use of cookies

On 4.5.2020, the European Data Protection Board approved guidelines on consent to the use of cookies (hereinafter "Guidelines") pursuant to Regulation 2016/679 of the European Parliament and of the Council, General Data Protection Regulation (hereinafter referred to as the „GDPR“).

Cookies and other elements monitoring the activity of website users are understood as personal data, as it is possible to identify a natural person (data subject) on the basis of them, and can therefore only be used with the expressed consent of the data subjects. Such consent must be in accordance with Article 4, paragraph 11 of the GDPR, ie. it must befreely given, specific, informed and unambiguous. Cookies are also regulated in parallel by Directive 2002/58 / EC of the European Parliament and of the Council, Directive on privacy and electronic communications. In its Article 5 (3) are regulated cookies for technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. Consent to use is not required for such cookies.

For other cookies, the conditions for obtaining consent to use are the same as in the regime of the GDPR (paragraph 7 of the Guidelines). Like the EDPB, the Office for Personal Data Protection has previously stated its similar opinion in its recommendation on the processing of cookies and similar means of monitoring since 25 May 2018 (hereinafter referred to as the “Recommendation”).

Freely given consent to the use of cookies

Freely given consent is one of the fundamental principles of European data protection. It is in this context that the EDPB comments on the practice of placing a cookie wall on a website – a setting that prevents access to the website or some of its functions unless the user agrees to the use of cookies. According to the EDPBs, this leads to a forced, non-free expression of consent (paragraphs 39 to 41 of the Guidelines). The EDPB gives an example:

"The website provider will implement functionality that blocks the visibility of the content and only the request for the acceptance of cookies and information on which cookies will be used and for what purpose the data will be processed is visible. Access to the content is not possible without clicking on the "I agree to use of cookies" button. As the data subject is not presented with an actual choice, his consent is not freely given."

Unambiguous expression of consent to the use of cookies

In connection with the expression of consent by simply scrolling the displayed website (so-called scrolling), the EDPB states that such action does not meet the condition of unambiguous expression of will. Moving the cursor around the screen or moving it does not constitute unambiguous consent. The main argument against scrolling is the fact that it cannot be revoked in the same way. Withdrawal of consent must be as easy as giving it (Article 7 of the GDPR).

Similarly, the EDPB noted that pre-filled "opt-out" windows also do not constitute consent (paragraphs 79-80 of the Guidelines). This case has already been resolved by the case law of the Court of Justice of the European Union (C-673/17):

“…It follows that the consent referred to in Article 2(f) and in Article 5(3) of Directive 2002/58, read in conjunction with Article 4(11) and Article 6(1)(a) of Regulation 2016/679, is not validly constituted if the storage of information, or access to information already stored in the website user’s terminal equipment, is permitted by way of a pre-ticked checkbox which the user must deselect to refuse his or her consent.“

The EDPB also considered the possibility of giving consent through web browser settings (paragraph 89 of the Guidelines). According to the EDPB, such consent is valid if it meets the conditions of the GDPR. The Office for Personal Data Protection similarly stated this in its Recommendation.

In our opinion, this is difficult to fulfill, given that web browsers do not allow the requirement of sufficient differentiation of the purposes of processing specific cookies (granularity). E.g. In the Google Chrome web browser settings, it is not possible to set the data subject to consent to the use of cookies for the purpose of analyzing the operation of the website (e.g. Google Analytics) and at the same time not to consent to the use of cookies for marketing purposes. This brings this variant closer to the cookie wall or scrolling with its actual effect.

In any event, consent must always be obtained before the controller starts processing personal data for which consent is required (so-called opt-in). Although the GDPR in Article 4 (11) does not explicitly state that consent must be given before processing, this is clearly indicated. WP29 (Working Group 29, paragraph 90 of the Guidelines) also stated this clearly and consistently in its expert opinions.

For more information, contact us at:

JUDr. Mojmír Ježek, Ph.D.

ECOVIS ježek, advokátní kancelář s.r.o.
Betlémské nám. 6
110 00 Praha 1
e-mail:mojmir.jezek@ecovislegal.cz
www.ecovislegal.cz

AboutECOVIS ježek advokátní kancelář s.r.o.
The Czech law office in Prague ECOVIS ježek practices mainly in the area ofCzech commercial law,Czech real estate law,representation at Czech courts, administrative bodies and arbitration courts, as well asCzech finance and banking law, and provides full-fledged advice in all areas, making it a suitable alternative for clients of international law offices. The international dimension of the Czech legal services provided is ensured through past experience and through co-operation with leading legal offices in most European countries, the US, and other jurisdictions. TheCzech lawyers of the ECOVIS ježek teamhave many years of experience from leading international law offices and tax companies, in providing legal advice to multinational corporations, large Czech companies, but also to medium-sized companies and individual clients. For more information, go towww.ecovislegal.cz/en.