1

I have spent lot of time to understand EU user consent policy with respect to usage of cookies. In summary, as I understand, I cannot save any cookies of my websites (including analytics cookies, adsense cookies, etc.) without user gives me consent to do.

I have been then looking for various external services which can provide this service. Most of the services I liked are paid ones. More over, I am looking for a different approach, that I could not see any of the services are currently offering.

I am thinking of implementation of the following plan for every users regardless of the place of origin. I like to hear from you, whether my implementation will be a violation of adsense policies.

Proposed implementation

(a) When user visit my website first time, the page will be loaded without analytics, adsense etc and wihhout storing any cookies. At this time, all links of the site will be disabled, menu items will be disabled, and users will be presented with a consent message at top of the screen (position fixed at top)

(b) if user accept consent message, I will save the consent in a cookie, page will be reloaded with all cookies.

(c) if user accept does not accept the consent message, I will redirect the users to a different page, telling, site cannot function without allowing cookies

(d) Every time, users will have option to change the consent given, in my privacy policy page.

(e) If a user change the consent to no, i will delete the cookie, reload the page to a different page, telling, site cannot function without allowing cookies.

Kindly suggest whether this approach is fine. thanks

0

What you are proposing where you don't allow any access to the site without consent is called a "cookie wall". A cookie wall is probably illegal under the GDPR. The GDPR states (emphasis added):

Recital 43 -- Freely Given Consent

  1. In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.
  2. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

So if consent isn't necessary to perform the action, you aren't allowed to require it. You also need to get different consent for each type of data collection, processing, and sharing that you do.

Forcing a user to give consent to access any of your site means that it is not "freely given". A user shouldn't have to consent to being tracked by advertisers just to be able to read information on your site.

Because there has been some debate as to whether or not the text of the GDPR actually makes cookie walls illegal, The European Data Protection Board issued a clarification that includes:

In order for consent to be freely given as required by the GDPR, access to services and functionalities must not be made conditional on the consent of a user to the processing of personal data or the processing of information related to or processed by the terminal equipment of end-users, meaning that cookie walls should be explicitly prohibited.

Changes to the GDPR and ePrivacy directive are in the works to make cookie walls explicitly illegal. So even if they are of questionable legality now, they will shortly be unquestionably illegal.

Sources:

  • thanks. if i just disable all EU users (not base on cookie, just disable based on ip), is that fine and ok legally? – user300718 Jan 23 at 14:53
  • California now has a new privacy law that is very similar to the GDPR. Whatever you do for EU, you should do for CA too. – Stephen Ostermiller Jan 23 at 15:10
  • It looks to me like the ways the laws are written, they don't apply if you are not located there and don't have customers in those locations. So blocking all customers from the EU should mean the GDPR would not apply to you. – Stephen Ostermiller Jan 23 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.