As per GDPR, how are the agree/disagree to cookie buttons to be designed?

Question

I just stumbled over this very... interesting cookie dialogue on the Ansible site:

How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?

Both buttons are the same color of blue when pressed, so there is absolutely 0 clear indicator on what I am exactly choosing. I don't know if this is a mistake or just pure malice to trick users into accidentally agreeing with all cookies, but it really annoyed me, and I want to know if the law actually says whether the consent has to be named clearly (as in, "I agree" vs "I disagree" etc.) - otherwise I can see this is a big loophole that people can abuse.

Also funny: You cannot open the "Privacy Statement" link on the bottom, because when trying to read that you are blocked by the cookie popup again.

Answer 1

GDPR defines consent like this in Art 4(11):

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Further conditions on consent are given in Art 7 GDPR.

For you, the important aspects are:

• Consent must involve an affirmative action (opt-in). Thus, consent cannot be the default and must not be pre-selected. The Planet49 judgement provides relevant case law on this.

• Consent must be an unambiguous indication of the data subject's wishes.

• Consent must be informed. This requires access to the full privacy policy.

• Abuse is discouraged because the data controller has burden of proof that valid consent was collected (see Art 7(1)).

How does the RedHat consent tool measure up?

• The consent appears to require an affirmative action and seems unambiguous: no option is pre-selected, and you need to click on “Out” or “In”. The selected option is then highlighted.

  However, I agree that the radio buttons are not entirely clear once a selection has been made. I also agree with you that the terms “Out” and “In” are not self-explanatory. They rely on the user knowing the terms “opt-out” and “opt-in”. This could indicate that the user's action isn't unambiguous.

• That the privacy policy page also shows a cookie consent popup could mean that consent isn't sufficiently informed.

So together, this isn't a particularly good design for a cookie consent tool. There are some potentially fatal problems that could render the consent invalid. However, it isn't obviously non-compliant – I have seen far worse.

Answer 2

After having looked at many cookie consent forms, of major companies and organisations, I've noticed an obvious pattern in how the design of the form is used to trick the user. Here's an example of the news website of the Belgian state-sponsored national broadcaster VRT:

The list of additional cookies, and whether they are enabled or not is clear enough; the buttons are grey when disabled and they turn green when enabled. However, the big green button at the bottom is not the "save these settings" button, but the "allow all cookies" button. What you have to click to enable only minimal cookies, required for the site to function properly, is the smaller text "Enkel minimale cookies aanvaarden" underneath the green button.

Someone who's in a hurry or not paying much attention will undoubtedly see the big green button, and click it because it looks like a typical "OK" button. Since this is the website of a semi-governmental organisation, it's clear that the rules about "informed consent" aren't enforced in any meaningful way.