Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
That is not a best practice, but some sites do this, particularly US or other non-European sites which are not attempting to comply with the GDPR. If the site is required to comply with the GDPR (because it is in Europe or has users who are in Europe), it depeends what lawful basis it is relying on.
If the basis is consent, then consent must be freely granted and may not be made a condition of site use/access unless the site cannot function without the information or cookie.
However, if some other lawful basis is being relied on, hen the site need not obtain consent, and may simply notify users that cookies are being set or read by the site.
Non-essential cookies require consent because the EU's ePrivacy directive says so, which in turn is implemented by the laws in each EU member state. While the applicable definition for “consent” is given in the GDPR, this is not directly a GDPR question.
Where does ePrivacy apply?
Unlike the GDPR, the ePrivacy directive doesn't have a clear geographic scope. This would instead depend on the laws in each member state. It is possible that non-EU websites aren't subject to ePrivacy.
On the other hand the ePrivacy directive “particularises” the data protection directive (replaced by GDPR), which has a clear geographic scope that can extend to non-EU websites if they offer services in the EU, or track people in the EU.
When is a cookie consent banner valid?
The conditions for valid consent are defined in GDPR Art 4(11) and Art 7. In particular:
- the consent must be informed: a cookie banner must provide enough information to make an informed decision
- consent is opt-in, not the default
- consent is a statement or affirmative action that indicates the wishes of the data subject
- “by continuing to use this site” is not an affirmative action in the sense of the GDPR1
- the data controller must be able to prove that they obtained valid consent
- consent must be as easy to revoke as it is to give
1: pre-GDPR, there was guidance that such approaches could represent valid consent. Post-GDPR, there are clearer conditions for consent, and previous guidance is being phased out.
Nearly all cookie banners fail these requirements:
- they might fail to provide sufficient explanation for an informed decision
- they might enable cookies by default, instead of being strictly opt-in
- they might fail to get an affirmative action and instead fabulate some kind of implicit consent (which doesn't exist)
Because consent is opt-in, it is not necessary that the data subject makes a decision: no response is the same thing as declining consent. So a cookie consent banner that only has an “I agree” button could be compliant. But consent must be freely given – it must be possible to use the website without consenting. This might not be the case for a popup-style cookie consent implementation.
Outlook on cookie consent
The cookie consent requirements are generally considered as overbearing and unsuccessful. They can lead to the absurd situation where setting a cookie requires a user's consent per ePrivacy, even though the purpose for which the cookie is used does not require consent under the GDPR.
There have been attempts to replace the ePrivacy Directive with an EU regulation that softens this consent requirements and is adapted to the GDPR. Unfortunately progress on the new regulation seems to have slowed down since 2017, and is still multiple years away from being applicable. Highlights of the proposed regulation:
- It recognizes that “Cookies can also be a legitimate and useful tool, for example, in measuring web traffic to a website.”
- It suggests that cookie consent management is centralized in the web browser.
- It requires that users are reminded every 6 months of their right to withdraw consent.
In the meanwhile…
Most cookie banners out there fail to be compliant. As discussed above, the ePrivacy cookie rules are inherently problematic. So there is a grey area between the law as written and the law as practised. EU websites should consider the stance of their data protection authority. E.g. the UK's ICO has announced a lax “risk-based” approach, whereas the French CNIL has announced a limited-time grace period while they update their guidance.