Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about conversion for a website, is it OK to let users confirm by using a button?
For example, like Mailchimp does:
The basic requirements for the effectiveness of valid legal consent are defined in Article 7 of the GDPR and specified further in Recital 32.
There is no form requirement for the consent, so using a button is not a problem.
However, I do not think the MailChimp-button you reproduce as an example is good enough. It asks for a blanket consent to stuff that is buried in MailChimp's “Anti-spam Policy & Terms of Use”.
But according to the GDPR, what the data subject consent to can’t be buried in the ToU – it must spelled out in clear, plain language. Requests must be granular, asking for separate consent for separate types of processing. “When the processing has multiple purposes, consent should be given for all of them” (Recital 32). Blanket consent, as used by MailChimp, is not allowed.
The other clear requirement from the GDPR is that opt-in is mandatory. Pre-ticked and opt-out buttons are explicitly banned: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent” (Recital 32). ‘No’ must become your data default, but if the user chooses to opt-in by clicking a button, this is valid consent. The MailChimp-button complies witrh this.
The GDPR also requires you to keep a records of the consents given (so make that part of the user profile), and to withdraw consent at any time – so you make make provisions for that as well in your implementation of consent.
A button would be the usual way of doing it. Companies more worried about proving informed consent in court if there is a dispute force you to click a box (and sometimes to open the document if they are really nervy) before you are allowed to click on the button.
