Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible.
Speaking of accessibility, some cookie consent solutions are not keyboard accessible, meaning that people with certain disabilities would not be able to manage their cookies either.
Is this compliant with GDPR, ePrivacy Directive, and the CCPA?
This is unlikely to pose a problem: most consent-requiring stuff happens only per JS, and consent must be opt-in anyway. However, accessibility concerns might be legitimate.
Cookies are usually set via a header field in the response from the web server. Such cookies are typically (but not necessarily) used for benign reasons like session tokens. And strictly necessary cookies do not require consent. In contrast, problematic uses of cookies are usually triggered by JavaScript code on the page. When JavaScript is disabled, it can't set cookies and asking for consent is unnecessary.
This brings us to the next reason: consent is opt-in. The ePrivacy directive requires consent for uses of cookies that are not strictly necessary, and GDPR Art 4(11) and Art 7 defines consent to be an opt-in through an affirmative action or expression that unambiguously indicates the visitor's wishes. Pre-checked boxes or “by continuing to use this page …” style consent mechanisms are uncompliant. If a website's mechanism for asking for consent doesn't work, it cannot assume that consent was given and is not allowed to perform the relevant data processing.
Of course, it's also possible to take an opposing view: that JavaScript is a core part of the HTML standard, and that user agents without JavaScript support break the correct functioning of the site at the visitor's peril. The site operator cannot reasonably ensure correct functionality of the site on such nonstandard browsers. But while this is a valid argument in the face of accessibility concerns, it doesn't matter for GDPR consent: the data controller has to be able to demonstrate that consent was actually given (Art 7(1)). While this proof doesn't have to be an explicit record, assuming consent from the absence of evidence seems uncompliant.
Does GDPR require accessibility? Not explicitly. Accessibility requirements can be derived from other laws. But the GDPR has some basic principles that point in this direction. As a special case for written declarations that also consider other matters, the request for consent must be in “an intelligible and easily accessible form” (Art 7(2)) which arguably also applies to textual media such as websites. More generally, the transparency principle in Art 5(1)(a) could be argued to imply accessibility for information regarding the data processing. For the context of the data subject rights, Art 12(1) provides details on how information must be given (transparent, intelligible, easily accessible, clear and plain language) and Art 12(2) requires data controllers to “facilitate the exercise of data subject rights”. This facilitation means that data subject shouldn't face unreasonable barriers to the exercise of their rights. A thoroughly inaccessible website could be such a barrier, e.g. putting contact info into an image.
However, it doesn't follow that specific features such as keyboard accessibility or ARIA markup are required by the GDPR. Even if we interpret the GDPR to require some level of accessibility, a data protection authority or court would have to look at the context: what level of accessibility can reasonably be required?
This answer primarily covers ePrivacy/GDPR as I have no deeper understanding of the CCPA. However, CCPA is arguably more accessible, because it mandates specific technologies (links) and titles (Do Not Sell My Personal Information) which happens to be quite accessible. CCPA also authorizes and demands further regulations to ensure that notices and information are accessible to consumers with disabilities.
