Does CNNs cookie consent banner comply with the GDPR?

Question

I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of specific cookies and it should allow for access to settings to change cookie preferences. Also consent is required prior to the cookie being set ( Not sure how that impacts Google Analytics? - We would have to integrate it with the cookie notification). Also notification must be renewed every 12 months.

Is all this true?

For example If I visit CNN in incognito mode, I just have to click the X in the cookie notification. Should / does CNN have to track that the X was clicked by the browser agent that holds the cookie that it is now tracking?

I imagine that when users agree to terms of service and privacy policy by signing up for an account they implicitly agree to the cookie policy?

Answer 1

Users of Google Analytics have to follow these rules too. Some webmasters add a banner like that to their sites simply because they use it. Those rules are correct.

For example If I visit CNN in incognito mode, I just have to click the X in the cookie notification. Should / does CNN have to track that the X was clicked by the browser agent that holds the cookie that it is now tracking?

Yes, CNN has to comply with those rules if people they apply to use the site. CNN most likely uses the user's IP address to store the information even if they are in incognito mode.

Answer 2

No, CNNs cookie consent banner does not comply with the GDPR for a number of reasons.

It looks like this:

We use cookies to understand how you use our site and to improve your experience. This includes personalizing content and advertising. To manage or opt out of the use of cookies click here. By continuing to use this website or closing this banner, you accept our use of first and third-party cookies

I accept         (X)

CNN seems to use opt-out where it must use opt-in;

Recital 32 clarifies that consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her. CNN assumes consent if given if the user continues to use their website. That is not a clear affirmative act, and also not unambiguous.

Article 7 (3) specifies that it shall be as easy to withdraw as to give consent. There is a single "Accept" button, while you have to click on a lot of buttons in the opt-out window. So it is clearly more difficult to withdraw consent.

Recital 43 clarifies that consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case. As there is a single accept button, this is not specific. The current opt-out window is more specific, this indicates the separate consent is appropriate in this case.

Should / does CNN have to track that the X was clicked...

GDPR only requires that the controller [is] able to demonstrate that the data subject has consented to processing of his or her personal data. There are other ways to demonstrate that, for example if you use a script which does not set cookies without consent. It is probably the easiest to use a cookie to track consent.