5

I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to that "Continue" button there is a text "By clicking Continue you accept Terms & Conditions" with link to those T&C - the link leads to a web page which presents T&C.

It this text along with link considered a valid GDPR unambiguous consent?

The form looks like this:

[boring payment form, name, credit card, CVV, email]
[text "By clicking BUY I confirm I have read & accept T&C"]
[link to general company T&C]
[link to mobile app T&C]
[link to privacy policy]
[BUY button]

An example of such "handling of consent" is what my Firefox just opened me as home page after updating it: enter image description here

it links to https://accounts.firefox.com/legal/terms and https://accounts.firefox.com/legal/privacy.

Improve this question
3
  • 1
    The answer really depends what the T&Cs contain. If they have clauses like "we will spam you" then you probably need a specific opt-in for that. So we need to know what the T&Cs are.
    – user
    May 30, 2018 at 10:57
  • but assuming that all those T&C are about proceeding the payment for the stuff I'm just buying, this is "unambiguous consent in context of GDPR"? (... of course in reality those T&C are NOT about proceeding the payment for the stuff I'm just buying, but let's assume they are)
    – Marian Paździoch
    May 30, 2018 at 10:59
  • If that assumption is true, then yes it's okay. But it had better really be true, e.g. no sly "we will mine your purchase history to target ads" etc, just literally the bare minimum required for the purchase. In that case consent is probably not required anyway.
    – user
    May 30, 2018 at 13:05

2 Answers 2

Reset to default
2

It almost certainly satisfies "unambiguous" (it isn't an opt-out).

But it may not be intended to be GDPR consent: "consent" is only one of the (six?) grounds for lawfully processing personal data; others included "technically necessary to provide the service". Amongst other things, this means that a payment form doesn't need GDPR consent to process your credit card number; it is absolutely fundamental to what the form is trying to do.

If the form is trying to obtain GDPR consent, then it may well not work. Firstly, hiding the T&Cs behind a link probably doesn't cut it; secondly, refusing to provide an unrelated service (which is what the "Continue" may be doing) if the user doesn't grant consent is outlawed too.

Improve this answer
1
  • "unambiguous" and "opt-in" are different concepts.
    – Acccumulation
    May 29, 2018 at 17:37
2

Not giving a picture of the page makes it more difficult, but this method arguably violates multiple guidelines of GDPR consent:

Active opt-on Consent requires a positive opt-in and avoid pre-ticked boxes or any other method of consent by default.

Unbundled

Granular

I.e. consent is given by giving consent, not by doing something else. Anything that says "By doing X, you are giving consent" is highly suspect.

Consent should be given in an action that does nothing but give consent. Any action that performs some action in addition to giving consent runs the risk of being considered "ambiguous", as a person can claim that they didn't notice the consent part, and thought they were just performing the other action.

Improve this answer
4
  • I edited the question to answer this concern "Not giving a picture of the page makes it more difficult".
    – Marian Paździoch
    May 30, 2018 at 10:34
  • There is very little difference between "By doing X, you are giving consent" and "To signify consent, do X". However, in the question's case, something like "We need your email address to make this work: enter it here to continue" would definitely be clearer.
    – Andrew Leach
    Jun 1, 2018 at 20:11
  • @AndrewLeach There is a HUUGE difference between the two if in the former, X is an inherently useful action, while in the latter, it exists only to signify consent. For instance, "By ordering our product, you are giving consent" is much different from "To signify consent, press the 'I signify consent' button".
    – Acccumulation
    Jun 1, 2018 at 20:17
  • Well, yes, "By ordering an item, you are giving consent to processing your details for this purpose" is certainly different to "Signify your consent by ordering an item". But if X is simply clicking a button, there is very little difference. If what X is is actually important, and different Xs mean different things, then using "X" in an answer isn't very useful.
    – Andrew Leach
    Jun 1, 2018 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .