Suppose a user visits a website. They are informed that the site is using cookies and analytics, and the user can either allow cookies or decline. If the user declines (and therefore is not tracked), does the website need to collect a record that the user declined?

If the user previously consented and then changed their line and deconsented, this makes sense to me to record. However, if the user has never consented and I've never tracked them, do I need to record this decline somehow?

Recording outright declines seems to be a feature of many commercial tracker management tools like OneTrue or CookiePro, but the language is confusing if this is something a website actually needs to do.

  • Common sense says: how else would you know not to track them?
    – user253751
    Nov 25 '20 at 17:38
  • @user253751 If the analytics tool requires the user to opt-in before it collects any data, then the website can assume not to track the user until told to do so. In the case where the user has declined, a cookie stored on the client would persist that preference. The data processor isn't going to have access to a cookie on a random client, so does that decline action (even in aggregate) need to be send to the data processor and persisted somehow? Nov 25 '20 at 18:20

Yes, setting a cookie to remember that cookies were declined is the most appropriate approach. No, you usually shouldn't send this info to your backend.

Many cookies require consent because the ePrivacy directive (closely related to the GDPR) says that you can only access information on a user device if (a) that access is strictly necessary for the service requested by the user, or (b) if the user consented to the access. Analytics are not strictly necessary in this sense, so analytics cookies always require consent.

When declining consent, the user is presumably asking to not be bothered by further consent popups for the forseeable time (e.g. 6–12 months). In fact, bothering a user on every page could be considered a dark pattern, and would call in question whether any consent given after such pestering could even be valid.

Thus, there is a strong argument that setting a cookie to remember “consent declined” or “consent withdrawn” is strictly necessary to perform the service requested by the user.

Setting a cookie is usually the least invasive way to manage consent status. For a logged-in user, storing consent status on the backend could also be very sensible. Persisting consent status about a not-logged-in user is a bit pointless, and I don't think the GDPR requires this in any case – this might even go against the data minimization principle. You don't necessarily have to record or persist consent status, but you have to be able to “demonstrate” that consent has been given if you rely on that consent. That includes demonstrating both the aspect that this user has given consent (which could benefit from explicit records), but also the more general aspect that this consent was obtained in a valid manner.

  • if usefr user consents are being stored on user side the user b can edit it.
    – ask
    Nov 26 '20 at 3:19
  • 1
    @ask yes, so? The user must be able to change their consent status anyway.
    – amon
    Nov 26 '20 at 6:36
  • No you did not understand what I meant.I meant that the user can show false records stating that the user does not give consent.I mean the bussinessd has no control over the user consent data to present in court
    – ask
    Nov 26 '20 at 8:47
  • If in case user goes to court the user can malaciously try to harm the bussinessd by showing false records.
    – ask
    Nov 26 '20 at 8:48
  • 1
    @ask That user would be committing fraud. The data controller could likely substantiate that they did in fact receive consent by having an expert witness explain the site's frontend's source code. Also, even if you persist records of consent, it would be difficult to associate these records with the user (for users that are not logged in). What kind of identifier would you use for these records? E.g. IP addresses change frequently and are not unique.
    – amon
    Nov 26 '20 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.