7

I just stumbled over this very... interesting cookie dialogue on the Ansible site:

a modal dialog of cookie consent

How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?

Both buttons are the same color of blue when pressed, so there is absolutely 0 clear indicator on what I am exactly choosing. I don't know if this is a mistake or just pure malice to trick users into accidentally agreeing with all cookies, but it really annoyed me, and I want to know if the law actually says whether the consent has to be named clearly (as in, "I agree" vs "I disagree" etc.) - otherwise I can see this is a big loophole that people can abuse.

Also funny: You cannot open the "Privacy Statement" link on the bottom, because when trying to read that you are blocked by the cookie popup again.

1
  • 1
    I often see this sort of thing on US sites that are pretending to comply with EU law. But I wouldn't trust any US-based organization to handle secure data, whether or not their website is nonsense. – alephzero Nov 20 '20 at 4:37
8

GDPR defines consent like this in Art 4(11):

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Further conditions on consent are given in Art 7 GDPR.

For you, the important aspects are:

  • Consent must involve an affirmative action (opt-in). Thus, consent cannot be the default and must not be pre-selected. The Planet49 judgement provides relevant case law on this.

  • Consent must be an unambiguous indication of the data subject's wishes.

  • Consent must be informed. This requires access to the full privacy policy.

  • Abuse is discouraged because the data controller has burden of proof that valid consent was collected (see Art 7(1)).

How does the RedHat consent tool measure up?

  • The consent appears to require an affirmative action and seems unambiguous: no option is pre-selected, and you need to click on “Out” or “In”. The selected option is then highlighted.

    However, I agree that the radio buttons are not entirely clear once a selection has been made. I also agree with you that the terms “Out” and “In” are not self-explanatory. They rely on the user knowing the terms “opt-out” and “opt-in”. This could indicate that the user's action isn't unambiguous.

  • That the privacy policy page also shows a cookie consent popup could mean that consent isn't sufficiently informed.

So together, this isn't a particularly good design for a cookie consent tool. There are some potentially fatal problems that could render the consent invalid. However, it isn't obviously non-compliant – I have seen far worse.

3
  • Will it be legal to inspect element and delete the modal? – compenthusiast Nov 19 '20 at 19:51
  • 2
    @compenthusiast I see no GDPR-related reason why “inspect element” could be illegal for users. I do that all the time to get rid of annoying popups and overlays (though the Element Zapper in uBlock Origin is usually more convenient). – amon Nov 19 '20 at 19:54
  • Ok . Then that is a legal solution to the popups and reader view is also. – compenthusiast Nov 20 '20 at 3:17
1

After having looked at many cookie consent forms, of major companies and organisations, I've noticed an obvious pattern in how the design of the form is used to trick the user. Here's an example of the news website of the Belgian state-sponsored national broadcaster VRT:

VRT news website cookie consent form

The list of additional cookies, and whether they are enabled or not is clear enough; the buttons are grey when disabled and they turn green when enabled. However, the big green button at the bottom is not the "save these settings" button, but the "allow all cookies" button. What you have to click to enable only minimal cookies, required for the site to function properly, is the smaller text "Enkel minimale cookies aanvaarden" underneath the green button.

Someone who's in a hurry or not paying much attention will undoubtedly see the big green button, and click it because it looks like a typical "OK" button. Since this is the website of a semi-governmental organisation, it's clear that the rules about "informed consent" aren't enforced in any meaningful way.

1
  • 2
    This doesn't appear to answer the question of what the requirements actually are, though. – Ryan M Nov 20 '20 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.