The EDPB Updates its Guidelines on Consent

On May 5, 2020, the European Data Protection Board (EDPB) published a slightly updated version of the WP 29 (i.e. former EDPB) guidelines on the GDPR consent of April 10, 2018.

The EDPB has provided further clarifications regarding:

– The validity of consent provided by the data subject when interacting with “cookie walls”;

– Example 16 on scrolling and consent.

As a result, the EDPB has revised the sections on Conditionality (paragraphs 38 – 41) and Unambiguous indication of wishes (paragraph 86). 

Access to website content cannot be conditional on the acceptance of cookies

In its updated guidelines, the EDPB reminds that:

  • GDPR consent should not be conditional on the provision of a service; 
  • Controllers should provide equivalent services to those who have not consented to the additional processing operations; and
  • The level of granularity of consent must be sufficient to give users the possibility to consent specifically to each purpose of processing subject to their consent. 

As a result, the EDPB has clarified its example on cookies wall and considers that cookies walls denying users access to a websites’ content as long as they have not accepted cookies is not compliant with GDPR requirements on consent.

Indeed, the acceptance of cookies would not be a genuine choice as it is a condition of access to the website’s content. 

Browsing a website is not a sufficient indication of consent

The EDPB considers an active motion or declaration may be valid consent provided that it is obvious that the data subject has consented to a particular processing purpose. 

Controllers must avoid ambiguity and ensure that the consent given can be distinguished from other actions. 

Therefore, the EDPB considers that continuing browsing a website including scrolling or swiping through webpages is not valid consent. 

On the other hand, waiving in front of a smart camera or turning its smartphone clockwise may be a valid consent if the other conditions of validity of consent are met. 

The EDPB Updates its Guidelines on Consent

This post is also available in fr_FR.

Tagged on: