4

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than offering a technical solution to prevent them from setting those cookies.

Firstly, let us assume that if you were to email them, they would instruct you to change your browser settings to block 3rd-party cookies.

As a second variant, let us assume that they would instruct you to disable all cookies, but that this would break minor functionalities of the site.

|improve this question
  • 1
    They are free to offer an opt-out by email. However that would not be GDPR related. Both GDPR as ePrivacy require opt-in. – wimh Aug 6 at 11:14
2

In principle, using email as an opt-out mechanism could be ok, at least in theory. But I see three issues with this:

  • A website visitor might not have an email address, yet the data controller is still required to honour the data subject's rights. (This might be far-fetched, but edge cases are interesting.)

  • The GDPR allows opt-out when the processing is based on legitimate interest. However, consent always required opt-in. While the processing of data for analytics purposes might be covered by legitimate interest as far as the GDPR is concerned, the GDPR is not the only applicable EU law here: ePrivacy requires consent for all non-essential cookies and related techniques. Thus, any opt out solution for cookies is invalid.

    What if the cookies are only set when the visitor consents on the website, but the visitor would have to write an email when they want to withdraw consent? That would be invalid, because consent must be as easy to withdraw as it is to give content.

  • Removing cookies through an email is technically impossible, unless the visitor has registered for a user account on the website with their email address. The reason is that cookies are stored on the visitor's device. The website has to abstain from setting new cookies in that user's browser, and has to delete existing cookies. But the website needs to know which visitor opted out – without a log-in there's no connection from the email address to the visitor's session on the website.

So all in all, this email-driven opt-out sounds like a really bad idea.

What about opting out from cookies by disabling all cookies in the browser? This is a problematic and disproportionate approach, as it would also break other sites. More importantly, some browsers do not support such fine-grained cookie controls, e.g. apps that use Android WebView. The website operator cannot get out of their data controller obligations by blaming the user's browser.

|improve this answer
  • More likely, the website might not have a link between the email address and whatever cookies it uses as persistent identifiers. – Paul Johnson Aug 8 at 11:01
  • Cookies stored on the user's computer are not actually covered by the GDPR. Its only data stored on the service provider's computers that is covered. In most cases the provider sets a cookie with a unique identifier and then uses that as an index to its database. – Paul Johnson Aug 8 at 11:03
  • When you say "That would be invalid, because consent must be as easy to withdraw as it is to give content." is this from GDPR. What specific wording does it come from? – Mark Fisher Aug 20 at 15:56
  • @MarkFisher This is almost verbatim from the GDPR. Article 7 covers conditions for consent. In paragraph 3, the last sentence says: “It shall be as easy to withdraw as to give consent.” Recital 42 additionally requires that refusing or withdrawing consent must be without detriment to the data subject. – amon Aug 20 at 16:40
1

No, this would not be legal under PECR as it requires consent from the user (although it may depend on the laws of the country where the company is situated if they're applied or not):

What do we need to do to comply?

The rules on cookies are in regulation 6. The basic rule is that you must:

  • tell people the cookies are there;
  • explain what the cookies are doing and why;
  • and get the person’s consent to store a cookie on their device.

As long as you do this the first time you set cookies, you do not have to repeat it every time the same person visits your website. However, bear in mind that devices may be used by different people. If there is likely to be more than one user, you may want to consider repeating this process at suitable intervals.

You may also need to obtain fresh consent if your use of cookies changes over time.

When the ePrivacy Regulation is finally published, this may change.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.