The European Data Protection Board (EDPB) has updated a section of the GDPR to give clearer advice around the use of consent on web pages.
The new advice now states that scrolling or swiping through a website should not be interpreted as "consent" and can no longer be used as a signal to begin tracking user data.
The board have also provided further clarification on the validity of "cookie-walls", reiterating to companies that the use of cookie consent boxes that require a user to consent in order to view content is in breach of GDPR.
ICO admits its own cookie policy is non-compliant with GDPR ICO wants to fix the data trust deficit General Data Protection Regulation (GDPR)
Where swiping or scrolling is concerned, the example given by the EDPB clarifies that the data controller must be able to demonstrate that consent was obtained this way and that data subjects must be able to withdraw consent as easily as it was given.
"Swiping a bar on a screen, waiving in front of a smart camera, turning a smartphone around clockwise, or in a figure-eight motion may be options to indicate agreement, as long as clear information is provided, and it is clear that the motion in question signifies agreement to a specific request (e.g. if you swipe this bar to the left, you agree to the use of information X for purpose Y. Repeat the motion to confirm.")," the guidelines state.
On the topic of cookie consent walls, the board specifically called out websites that prohibit access to content unless consent is given.
RELATED RESOURCE
Don’t just collect data, innovate with it.
Removing the barriers to the experience economy
"A website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set and for what purposes data will be processed," the guidelines explain.
"There is no possibility to access the content without clicking on the 'Accept cookies' button. Since the data subject is not presented with a genuine choice, its consent is not freely given. This does not constitute valid consent, as the provision of the service relies on the data subject clicking the 'Accept cookies' button."
Although much of the guidance is already set out under GDPR, some ambiguity in the text has led to incongruity in the application of the law on websites across Europe.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
India’s new data protection bill continues to “facilitate state surveillance”News Although data localisation requirements have now been removed, it’s down to the Indian government to select which countries data is allowed to be sent to
-
LinkedIn denies data breach that reportedly exposed 700 million user recordsNews Report claims 'breach' led to profiles belonging to 92% of LinkedIn users being put up for sale on a popular hacker forum
-
Privacy campaigners rally against "illegal" Clearview AI data scrapingNews The notorious facial recognition firm claims to have a database of more than three billion images scraped from social media sites
-
Germany bans Facebook from using WhatsApp data over GDPR concernsNews Hamburg's data protection commissioner issues three-month ban days before the app's new privacy policy rolls out
-
Facebook faces 'mass action' lawsuit over data breachNews Digital Rights Ireland is urging European Facebook users who have been affected to sign up
-
Irish data watchdog to investigate Facebook data leakNews The regulator believes that Facebook may have infringed ‘one or more’ GDPR provisions following apparent leak of 533 million user records
-
EU might force tech giants to share data with smaller rivalsNews The Digital Services Act draft also suggests that firms may be banned from giving their own services preferential treatment
-
Irish data watchdog orders Facebook to halt EU user data transfers to the USNews Nick Clegg suggests cancelling its transfer mechanism could cause chaos for businesses and the global economy
