Adsense - Proposed implementation of EU user consent policy

Question

I have spent lot of time to understand EU user consent policy with respect to usage of cookies. In summary, as I understand, I cannot save any cookies of my websites (including analytics cookies, adsense cookies, etc.) without user gives me consent to do.

I have been then looking for various external services which can provide this service. Most of the services I liked are paid ones. More over, I am looking for a different approach, that I could not see any of the services are currently offering.

I am thinking of implementation of the following plan for every users regardless of the place of origin. I like to hear from you, whether my implementation will be a violation of adsense policies.

Proposed implementation

(a) When user visit my website first time, the page will be loaded without analytics, adsense etc and wihhout storing any cookies. At this time, all links of the site will be disabled, menu items will be disabled, and users will be presented with a consent message at top of the screen (position fixed at top)

(b) if user accept consent message, I will save the consent in a cookie, page will be reloaded with all cookies.

(c) if user accept does not accept the consent message, I will redirect the users to a different page, telling, site cannot function without allowing cookies

(d) Every time, users will have option to change the consent given, in my privacy policy page.

(e) If a user change the consent to no, i will delete the cookie, reload the page to a different page, telling, site cannot function without allowing cookies.

Kindly suggest whether this approach is fine. thanks

Answer 1

What you are proposing where you don't allow any access to the site without consent is called a "cookie wall". A cookie wall is probably illegal under the GDPR. The GDPR states (emphasis added):

Recital 43 -- Freely Given Consent

1. In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.
2. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

So if consent isn't necessary to perform the action, you aren't allowed to require it. You also need to get different consent for each type of data collection, processing, and sharing that you do.

Forcing a user to give consent to access any of your site means that it is not "freely given". A user shouldn't have to consent to being tracked by advertisers just to be able to read information on your site.

Because there has been some debate as to whether or not the text of the GDPR actually makes cookie walls illegal, The European Data Protection Board issued a clarification that includes:

In order for consent to be freely given as required by the GDPR, access to services and functionalities must not be made conditional on the consent of a user to the processing of personal data or the processing of information related to or processed by the terminal equipment of end-users, meaning that cookie walls should be explicitly prohibited.

Changes to the GDPR and ePrivacy directive are in the works to make cookie walls explicitly illegal. So even if they are of questionable legality now, they will shortly be unquestionably illegal.

Sources:

• Cookie walls don’t comply with GDPR, says Dutch DPA | TechCrunch
• Cookie walls | EU DPAs on cookie walls and consent (especially the "Is a cookie wall legal?" section)