2

We have a web application (+1000 users) and we use analytics cookies and have also some cookies that are required for the application to work.

Before the user creates an account, it has to accept both "Terms of use" and "Privacy policy" that we provide in the registration screen.

If the user accesses the application landing-page (not the app itself), we do show the cookie modal to ask for consent and etc.

My question is if we do need to have this modal for consent inside the application (after login) even if the user already has agreed with stuff on account creation?

1
  • Note that the rules around cookie are not based (only) on the GDPR but also on the ePrivacy directive, i.e. directive 2002/58/EC.
    – Relaxed
    Mar 10 at 14:11
1

To the extent that you deem consent necessary then it must be specific to the use of cookies. C-673/17 primarily dealt with a pre-selected checkbox but the court specified that a general consent to participate in a lottery was not enough to infer consent to the use of non-essential cookies.

At the same time, it is not always necessary to ask consent to use cookies. As detailed by the Dutch Data Privacy Authority cookies that are strictly necessary to provide a service and some analytics cookies may be used without explicit consent. It goes on to explain that a “cookie wall” (blocking the use of a service unless you agree to non-essential cookies) vitiates consent. Forcing users to agree to all terms and conditions with no possibility to register without “consenting” to non-essential cookies would violate this principle.

Either way, agreement to general terms and conditions is not a proper basis to use cookies and there is no reason to treat registered and unregistered users differently in this respect (which is not to say that you always need a modal). Note that you are also allowed to use cookies to store cookie preferences across visits.

Also interesting: Article 29 working party guidelines on consent. This is about the GDPR but the ePrivacy directive refers to the — repealed — directive 95/46 it replaces, cf. article 94 of regulation 2016/679 and article 2(f) of directive 2002/58/EC.

0

You must obtain consent for using any cookies that are not strictly necessary to perform the service requested by the user. This stems from the ePrivacy directive, respectively your country's implementation of this directive. Consent is currently defined by the GDPR. It does not matter whether the cookies actually involve personal data.

Cookies that are necessary for the application to work (e.g. session cookies, authorizations, preferences, shopping cart contents) are likely strictly necessary. They pose no problem, although you should provide transparent information about the use of these cookies in your privacy policy.

Analytics are not strictly necessary. Before using cookies or similar technologies for analytics, you will need to obtain consent.

“Consent” under the GDPR has fairly high requirements. It requires that the user has made a conscious decision, that they made the decision freely and informed, and that they can give/withhold consent for specific purposes – bundling is not allowed.

  • The user must indicate their consent through a clear statement or affirmative action, e.g. clicking a button or ticking a checkbox. This indication of consent must be unambiguous. Agreement to your terms of service or to your privacy policy cannot be GDPR consent for anything mentioned in these documents because you cannot be sure that the user intended to give consent also for those purposes. Consent should never be bundled with other documents, but should be clearly separated from other matters.

  • You cannot bundle consent. When you ask for consent for different purposes, the user must be able to give consent to one but withhold consent for another. This is another reason why agreement to a privacy policy cannot constitute consent.

  • You cannot make a service conditional on unrelated consent. Users must be able to use your application without giving consent to analytics cookies. Of course, it is possible to make a service conditional on related consent, e.g. of course a videoconferencing system can only work if the users gives consent to access camera/microphone.

  • Consent must be informed. The user must actually understand what they are consenting to. Typical privacy policies are far too long and complex to expect anyone to actually read them. Instead, you should use a layered approach: when asking for consent you should describe the key aspects of what the user would be consenting to, and link to your privacy policy for the full details.

If you do not collect valid consent, the resulting processing activities are illegal. You as the data controller must be able to demonstrate that valid consent was obtained. This is often interpreted to mean that you must store a record that registers the consent event for later audit. I think it is more important to ensure that your consent flow is demonstrably GDPR-compliant, in particular that you can show that users' consent is informed and freely given.

I therefore think that you will have to show your cookie dialog within your app as well. You should not set or access analytics cookies until such consent has been given. You cannot assume that consent has been given by default: consent is opt-in, not opt-out.

Sources:

  • Cookie consent is required by ePrivacy Art 5(3), where cookies correspond to “information […] in the terminal equipment of a subscriber or user”. Exempted from the consent requirement are cookies that are technologically necessary, and access “as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”. National law must provide equivalent conditions.
  • Consent is defined in GDPR Art 4(11) and applies for cookie consent per ePrivacy Art 2(f) in conjunction with GDPR Art 94.
  • Conditions for consent are expanded in GDPR Art 7.
  • The EDPB has endorsed guidelines on transparency, which suggest a layered information approach rather than expecting users to read the entire privacy policy.
  • The EDPB has issued guidelines on consent.
10
  • This answer is wrong regarding analytics. It also talks at length about the GDPR while failing to explain why it applies here or referencing the actual source of the rules on cookies.
    – Relaxed
    Mar 10 at 15:25
  • @Relaxed Ok, I've added a short discussion of the ePrivacy–GDPR link. But GDPR is highly relevant since it defines consent. There are no cookie-specific consent rules. Could you explain how I am “wrong regarding analytics”? Analytics cookies clearly require consent under ePrivacy Art 5(3), though it would be possible to perform basic anonymous analytics with traffic data (not cookies) without consent under ePrivacy Art 6.
    – amon
    Mar 10 at 15:40
  • Indeed, I already explained all that, without the generic GDPR fluff, in my answer. I just found it odd that you went about it without even bothering to explain why it was important or mentioning the actual legal basis at all. I think spelling that out improves your answer.
    – Relaxed
    Mar 10 at 15:48
  • Regarding analytics, on what do you base your interpretation of article 5(3)? Data protection authorities do not seem to share it (I referenced the Dutch one because the OP is apparently located in the Netherlands). Basic anonymous analytics could presumably fall under the “carrying out or facilitating the transmission of a communication over an electronic communications network” clause (although the document I cited does not seem to rely on that).
    – Relaxed
    Mar 10 at 15:50
  • Beyond analytics, if you follow the letter of article 5(3), your first sentence also seems misleading. There are two clauses: “carrying out or facilitating the transmission of a communication over an electronic communications network” and “strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”. Whatever your interpretation of the former might be, it cannot be the case that legitimate use of cookies (without consent) is limited to the latter. You only quoted part of this sentence, without indicating that it was a partial quote!
    – Relaxed
    Mar 10 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.