3

Seven years ago: Where to store users consent (EU cookie law)

Now: A new GDPR approaches on the websphere....
So now with the GDPR coming in effect next month I'm faced with a cookie law question again.

Since cookies are now classified as personal data there is this consent requirement that is a bit stricter. And since the fines are higher also(4% of year sales), I want a check on what is correct.

My current hunch is:

Store the consent in a cookie, so the site knows what the do -> The functional aspect
Store the consent also serverside in a database -> The legal burden of proof aspect

But what bothers me and I can't find anywhere is:

Do I really need to store the consent also serverside? It does touch on the processing personal data requirement etc... which leads me to saying yes, but i'm not a lawyer nor an expert in the new cookie law.

What would be the wisest approach for handling these permissions?

Improve this question
4
  • 1
    Should be noted as far as I know no company in existence has been fined or prosecuted for not having cookie consent or notify. GDPR is another gimmick which won't be enforced, not saying not too but don't expect a knock on your door either :)
    – Simon Hayter
    Apr 13, 2018 at 17:55
  • I'm fully aware of that. But in the netherlands up until now you'd get a written warning and time to comply. But now the warning phase is skipped and 4% of your sales can be fined, without warning, and the authority responsible has let it known that they'll actively enforce the rules(why the hell not, its a good cash cow for the govt)
    – Tschallacka
    Apr 13, 2018 at 18:26
  • Given the trivial cost of coding and storing in a database, why not do it...
    – Steve
    Apr 13, 2018 at 22:38
  • At 25.000 visitors a day it adds up relatively quick.
    – Tschallacka
    Apr 13, 2018 at 22:42

1 Answer 1

Reset to default
2

As with most things in law, if sued, the burden of proof is on both parties to state their case.

In the event that your website/company was ever brought to court over GDPR, you would have to assume that evidence has been gathered against you that shows your visitors were not giving consent. Thus, you want to be able to prove that they did.

If the government ever began questioning you over GDPR, showing them a record of consent may likely be enough for them to leave you alone. Whereas not providing recorded evidence could cause even more questions to be raised.

As a result, you should strongly consider storing all of the consent that users give you. If there is no record of consent, then it may be difficult for you to prove in a court of law that you abided by GDPR consent requirements.

The likelihood of ever getting put under pressure from GDPR law seems incredibly low. But you never know, especially with new political leaders taking office regularly.

Caveat: I'm not a lawyer and this is not law advice.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.