36

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it seems to me that there is a catch 22 here: they specifically refused the storage of their data, and now the website is supposed to store that somehow.

How can you store that information in a compliant way?

My initial thought is to use a cookie, but would that be non-compliant? They did just refuse the storage of cookies on their device... And if I store it in a database somewhere, how am I supposed to associate that refusal with that user if I can't store personal information?

According to the accepted answer to this question, you can use a userId or some such. But first of all that is in the context of consenting, not refusing, to cookies; secondly, if that identifier is associated with a user, then by definition it is personal data (right?) and therefore storing that information would be non-compliant.

Regarding the storage of consent, is it enough to store that in a cookie on the user's device or do you really need to store it in a database somewhere? That really seems superfluous to me.

Improve this question
7
  • 6
    Where do you see that refusal needs to be stored?
    – Greendrake
    May 19, 2020 at 6:22
  • 2
    So that says about the need to prove consent. Where does it say about the need to prove refusal?
    – Greendrake
    May 19, 2020 at 6:51
  • 12
    Not all cookies require consent. You only need consent for accessing storage on a "terminal device" (= web browser) if the access isn't strictly necessary for the service requested by the user. There is a fairly good argument that recording the refusal in a cookie is strictly necessary, in order to avoid nagging the user with consent requests upon subsequent page loads.
    – amon
    May 19, 2020 at 7:05
  • 1
    Ah, I see what you mean, I misinterpreted "even if that consent has been withdrawn".
    – Jackson Holiday Wheeler
    May 19, 2020 at 7:20
  • 1
    Some sites do this by nagging me every time I load them if I refused them the previous time. I wouldn't recommend it, it's very annoying.
    – vsz
    May 20, 2020 at 4:29

2 Answers 2

Reset to default
38

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for the provision of an information society service requested by the subscriber or user".

It does not require you to seek consent for the use of any cookie no matter what function it has.

"Strictly necessary" cookies include those necessary for the website to comply with the law.

Per guidance from the Information Commissioner's Office (ICO) in the UK (see the example box), a cookie set in relation to such consent or refusal is fine - it's for compliance with the cookie law. I would expect similar guides throughout the EU.

You must consider its duration or lifespan: "For example, whilst it may be technically possible to set the duration of a cookie to “31/12/9999” this would not be regarded as proportionate in any circumstances."

And consider including information about it in your cookie policy or such that users can find out more if they want.

Improve this answer
2
  • Makes perfect sense, thank you for the detailed answer! We'll use a cookie, then :D
    – Jackson Holiday Wheeler
    May 19, 2020 at 7:21
  • 1
    good answer, that's how many of the commercial solutions out there work and the way mine also works.
    – Simon
    May 19, 2020 at 14:15
4

Non-personalized cookies

GDPR is not about cookies, it's about processing personal or identifiable data, and even for that it has explicit "legitimate need" basis that allows processing data as long as the data minimization principle is followed.

If the goal is to simply avoid repeatedly asking for the same thing, you don't need to know, store or process who refused consent - so the appropriate way to go would be to avoid any unique identifiers, session IDs, etc and simply place a cookie "consent-request:refused" or something like that.

Improve this answer
1
  • 3
    While it is true that the GDPR is not about cookies, the closely related ePrivacy directive introduces more specific requirements, importantly that cookies or similar technology can only be used when they are strictly necessary OR when the user has consented. Even if the cookie doesn't contain any personal data! Of course an EU directive has no immediate effect, so each country's implementing law has to be considered instead (e.g. PECR in the UK or TMG in Germany).
    – amon
    May 21, 2020 at 6:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .