We'd like to remind Forumites to please avoid political debate on the Forum... Read More »
GDPR and Cookies
the_lunatic_is_in_my_head
Posts: 9,029 Forumite
Purely out of interest, I looked at the Daily Mail a few weeks back and noticed I could either accept cookies or pay, random link today sent me to the Independent which also has the same idea.
I thought under EU law sites (based in the EU, or perhaps targeting people in the EU) had to offer the same access to all regardless of whether or not they accept non-essential cookies and forcing them to accept to gain access isn't really consent.
Seems to be Art. 7 GDPR which says:
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
and the ICO says (rather a lot so best to read the link rather than me pasting it but they seem to come to the same conclusion):
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/#what2
I know we've left the EU and some laws are changing, given the Mail and Independent are big business you could assume they are doing what they are allowed to so I guess my question is how are they allowed to do so?
I thought under EU law sites (based in the EU, or perhaps targeting people in the EU) had to offer the same access to all regardless of whether or not they accept non-essential cookies and forcing them to accept to gain access isn't really consent.
Seems to be Art. 7 GDPR which says:
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
and the ICO says (rather a lot so best to read the link rather than me pasting it but they seem to come to the same conclusion):
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/#what2
I know we've left the EU and some laws are changing, given the Mail and Independent are big business you could assume they are doing what they are allowed to so I guess my question is how are they allowed to do so?
In the game of chess you can never let your adversary see your pieces
0
Comments
-
What are commonly called “essential cookies” are exempt from the requirement for consent. That is those that are needed for the correct technical operation of the site.There is no proscription about what can be asked to gain consent only that it is upfront, clear and not deceptive.Putting these two together I can’t see that the Independent or Daily Fail are doing anything wrong. In fact you could say they are being exceptionally clear in stating outright that cookies are used for advertising and giving a choice.0
-
Well if the quality of their reporting is anything to go by.I know we've left the EU and some laws are changing, given the Mail and Independent are big business you could assume they are doing what they are allowed to so I guess my question is how are they allowed to do so?
No, they will not have a clue if they are allowed to do it or not.🤣Life in the slow lane1 -
If the advertising cookies could simply be labelled essential all websites would bundle them in with the consent to essential cookies and the website would have to argue that it is the processing of personal data that is necessary for the performance of that contract, which it clearly isn't.PHK said:
What are commonly called “essential cookies” are exempt from the requirement for consent. That is those that are needed for the correct technical operation of the site.There is no proscription about what can be asked to gain consent only that it is upfront, clear and not deceptive.
The ICO example covers this:
An online furniture store requires customers to consent to their details being shared with other homeware stores as part of the checkout process. The store is making consent a condition of sale – but sharing the data with other stores is not necessary for that sale, so consent is not freely given and is not valid. The store could ask customers to consent to passing their data to named third parties but it must allow them a free choice to opt in or out.
The store also requires customers to consent to their details being passed to a third-party courier who will deliver the goods. This is necessary to fulfil the order, so consent can be considered freely given - although ’performance of a contract’ is likely to be the more appropriate lawful basis.
PHK said: In fact you could say they are being exceptionally clear in stating outright that cookies are used for advertising and giving a choice.
They are indeed and I did wonder if that was the answer however the ICO also says
The UK GDPR is also clear that people must be able to refuse and withdraw consent without being penalised:
“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”
The ICO’s view is that it may still be possible to incentivise consent to some extent. There will usually be some benefit to consenting to processing. For example, if joining the retailer’s loyalty scheme comes with access to money-off vouchers, there is clearly some incentive to consent to marketing. The fact that this benefit is unavailable to those who don’t sign up does not amount to a detriment for refusal. However, you must be careful not to cross the line and unfairly penalise those who refuse consent.
Seems a fair to suggest that having to pay to reject non-essential cookies is being penalised or suffering detriment?
Looking further the issue in the UK seems to stem from the ICO wishing websites to place "reject all" next to "accept all" rather than hiding it behind a "more options" button:
https://pressgazette.co.uk/marketing/ico-reject-all-button-threatens-free-news-consent-pay/
with news sites concerned 30% would reject losing them revenue.
Seems the issue sits on whether this is freely given consent.
https://www.admeet.eu/en/assessing-the-legality-of-a-cookie-wall-on-a-website/
Belgium and Italy have said it's not free consent whist Germany generally views it as free consent so no central clarification on the matter at this time.In the game of chess you can never let your adversary see your pieces0 -
I think you’ve missed the point. Advertising cookies are not personal data (data that can be used to identify you or could be combined with other data to identify you) therefore much of what you quote isn’t relevant.1
-
Link above (admeet) says:PHK said:I think you’ve missed the point. Advertising cookies are not personal data (data that can be used to identify you or could be combined with other data to identify you) therefore much of what you quote isn’t relevant.GDPRWhen a website publisher collects information through the use of cookies, it is using/processing data that is considered to be personal data.The GDPR therefore also has an impact on the way in which this data collection must take place.In the game of chess you can never let your adversary see your pieces0 -
It seems to be that the arrangement is entirely consistent with the GDPR rules.Purely out of interest, I looked at the Daily Mail a few weeks back and noticed I could either accept cookies or pay,
Seems to be Art. 7 GDPR which says:
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
A contract requires offer and acceptance and a contract cannot be formed unless there is "consideration".
The Daily Mail have simply offered to provide their service (access to the website) and the offer allows for two types of "consideration":- Money (payment)
- Accept Cookies (through which advertising revenue can be raised)
As an alternative to online services, it is possible to access the Daily Mail by a jolly jaunt to the Newsagents and paying. Certainly no cookies then.2 -
Seems a fair to suggest that having to pay to reject non-essential cookies is being penalised or suffering detriment?
I am not sure I would agree with that. Reading the Daily Mail or the Independant are not things that anyone needs to do or is required to do - it is a choice, and you can choose not to read them. Some people might think reading the Daily Mail is a detriment! If you go to the newsagent then you must buy the paper, and you get the adverts they publish anyway. I don't see the difference. You are buying a service - a news service - just as you would buy any other service.0 -
There are very few things people need to do, the idea of detriment is within the context of the service of being offered rather than whether you need it for your basic survival.LinLui said:Seems a fair to suggest that having to pay to reject non-essential cookies is being penalised or suffering detriment?
I am not sure I would agree with that. Reading the Daily Mail or the Independant are not things that anyone needs to do or is required to do - it is a choice, and you can choose not to read them. Some people might think reading the Daily Mail is a detriment! If you go to the newsagent then you must buy the paper, and you get the adverts they publish anyway. I don't see the difference. You are buying a service - a news service - just as you would buy any other service.
The difference is the ads in the printed paper don't track you in the same way, I have no objection to seeing adverts (well would be nice not to but such is life) which are still presented online when you reject non-essential cookies, it's the tracking aspect that is up for discussion.
I couldn't find the answer when Googling last night, having had another look this morning it seems to solely hinge on whether it's free consent which is currently unclarified, hopefully given the robustness of the data protection in the EU it will at some point be deemed to be in violation and, again hopefully, the UK will follow with the same interpretation.Grumpy_chap said:
It seems to be that the arrangement is entirely consistent with the GDPR rules.Purely out of interest, I looked at the Daily Mail a few weeks back and noticed I could either accept cookies or pay,
Seems to be Art. 7 GDPR which says:
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
A contract requires offer and acceptance and a contract cannot be formed unless there is "consideration".
The Daily Mail have simply offered to provide their service (access to the website) and the offer allows for two types of "consideration":- Money (payment)
- Accept Cookies (through which advertising revenue can be raised)
As an alternative to online services, it is possible to access the Daily Mail by a jolly jaunt to the Newsagents and paying. Certainly no cookies then.
In the game of chess you can never let your adversary see your pieces0 -
It sounds like you are referring to these 'consent or pay' options that have suddenly cropped up in return for accepting non-essential cookies.
The ICO launched a consultation earlier this year that closed on 17 April.
Link: Call for views on “consent or pay” business models | ICO
On the same day of the consultation closing, the European Data Protection Board released an opinion. In summary, they said that for most consent or pay options, businesses would not be able to meet the requirements for valid consent, but it is not an absolute prohibition. There must be an assessment made by the business based on certain criteria.
Link: EDPB: ‘Consent or Pay’ models should offer real choice | European Data Protection Board (europa.eu)
You may also want to read the ICO's Draft Journalism Code of Practice which talks about the journalism exemption and there's a reference to paywalls in paragraph 13.14.
Link: data-protection-and-journalism-code-202307.pdf (ico.org.uk)
The current situation is, I believe, a bit of an uncertain moment. Companies like the Daily Mail appear to have taken the anticipated step of implementing these pay or consent models but the ICO is still currently consulting on whether this is still appropriate in light of the EDPB opinion. In other words, they're pushing the boundaries until they are told otherwise.
The EDPB opinion will carry some weight in the UK but we are no longer part of the EU so the ICO could very well deviate from the EU position and I would expect to see cases being brought to court over the next few years determine the legal position. Should also remember that the UK GDPR hasn't materially changed compared to the EU GDPR.
If I recall, France and Netherland regulators had declared that consent or pay models violated the GDPR but have since withdrawn that allegation, and I believe Germany did have the same view but have since provided updated guidance based on the EDPB guidance. The Danish regulator states in their guidance that if businesses are offering a payment in lieu of consenting to cookies, the price of payment should not be unreasonably high.
There is some inconsistency in views across Europe but we will have to wait and see how it pans out. The ICO has been called out by the courts in the past having held on some occasions that its guidance is wrong so even if the ICO takes the view that consent or pay is compliant, a court could still overule it if a valid argument is put forward.2 -
If you do pay to reject non-essential cookies, is that on a per-session basis, or a one-time basis, or something in-between? And if you have paid, haven't they then got even more personalised data than would be accrued via cookies? 🤷♀️Jenni x0
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 349.7K Banking & Borrowing
- 252.6K Reduce Debt & Boost Income
- 452.9K Spending & Discounts
- 242.6K Work, Benefits & Business
- 619.3K Mortgages, Homes & Bills
- 176.3K Life & Family
- 255.5K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.1K Discuss & Feedback
- 15.1K Coronavirus Support Boards