0

I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?

I have made a specific consent function like this: When user first visit website and uses the functions, there is a empty consent checkbox: "Save my details in a cookie so I don't need to enter them everytime".

IF the user gives consent, checks the checkbox, and proceeds, the details are now saved in cookie.

Next time user visit website, the checkbox will now be pre-ticked (as the user previously given consent). If the user wants to revoke or recall the consent, the user can now uncheck the checkbox and proceed, and the cookie will be deleted.

Technically, it works by checking for presence of the said cookie, if cookie is present, box is pre-checked, else box is empty.

I wonder, is this valid consent according to GDPR, and is it permittable to use a pre-ticked checkbox to revoke/recall consent?

I see two legal problems with this: 1: If the user checks the checkbox, and then another user uses the same computer, or the user forgets he consented, the user could believe its an invalid consent as the box is pre-checked. 2: If GDPR law requires the revocation of consent be a separate function and not built-in the consent checkbox, it could be problematic.

Also, I wonder, if I use this scheme and totally locally controlling this function, it will mean that I as a website owner will NOT be able to revoke consent on behalf of the user, only way for the user to revoke his consent is to uncheck the checkbox or delete his cookies.

Is it valid to do this, or MUST I be able to revoke consent on behalf of a user if a user emails and wants to revoke consent, or can I refer user to uncheck that checkbox? Since the details is stored in a cookie, only way for me to revoke consent would be to somehow "ban" that cookie from being activated later on from the server side, requiring me to store personal details of users (either IP-adresses of computers which the cookies should not be respected from and immidiately deleted, or users email adress to "ban" the content of the cookie to be used, and immidiately delete all cookies containing that email adress)

Another thing is that since the function is locally controlled, it means that I don't know or store which users have consented, meaning I do not have any records of consent from users. HOWEVER, since the function is built in such a way that it will only place the cookie if consent is received, it would be sufficent as "consent proof" right?

1
  • The problem with your first legal “problem” is that its no different to a user signing up for an account, using the service and then a second user jumps on the same computer and uses the account logged in as the first user. So far, the GDPR hasnt seen this as an issue that the website needs to solve, and its identical to your use case.
    – Moo
    Jun 10 at 1:12
1

The GDPR doesn't impose specific requirements on how consent may be revoked, other than that withdrawing consent must be as easy as giving it. If the original consent is given via a checkbox, and if that checkbox is compliant, then withdrawing consent through the same checkbox should also be compliant. It might be appropriate to regularly remind the user that they can withdraw consent, e.g. by expiring the cookie after 12 months. It could also be a good idea to indicate that the user enabled this themselves, e.g. by showing the timestamp when consent was given.

However, I am not convinced that consent is required in this scenario. While the definition of consent comes from GDPR, the cookie consent requirement comes from the ePrivacy directive which is then implemented in national laws. The ePD talks more generally about information stored on a terminal device of the "subscriber or user". Accessing such information (including but not limited to cookies) usually requires consent of the subscriber or user, but there is an exception for access that is strictly necessary for a service explicitly requested by the user to work. There are some consequences from this:

  • You might not need consent for setting the cookie if such storage is strictly necessary for your website to work. If your site features a log-in you could in theory also store the information server-side, but client-side storage might actually be more privacy-friendly.

  • At least, checking whether a consent cookie is set does not require consent since such access is strictly necessary for a consent mechanism to work.

  • It is not a problem if multiple people share a browser profile. Since this is an ePrivacy issue, you do not need the consent of the data subject but the consent of the subscriber or user.

Cookie consent is typically managed purely client-side, and I have never heard of functionality for a website operator to withraw consent on behalf of the user. If a website operator is concerned about this, they could offer a link that goes directly to a consent management panel.

However, information about consent and withrawal events might be stored server-side. The GDPR requires that you can "demonstrate" that consent was given validly. For example, you should be able to show that the request for consent had enough information for the consent to be freely given, specific, and informed. Most cookie consent solutions also store a server-side timestamp for consent/withrawal events in order to have an auditable history that proves when consent was given or withdrawn. But unless there are user accounts, it's of course difficult to tie such events to a browser session.

2
  • The website is a webshop in question, and the cookie system is just for remembering check out details. All details are saved in clear-text in a cookie, and the fill-in system is purely client side. So its not "strictly neccessary" cookie, but more a cookie in the group "preference cookie". Theres no account or login but more of a "express checkout" system, thats why I offer a checkbox with remembering the details so the user doesn't have to fill them in all the time. Jun 13 at 13:37
  • What I have understand, "demonstrate" that consent was given validly, should only require that I can show that the solution does not place a cookie or store personal details unless consent is given? I read on a GDPR site that if the solution is built so for example, details isn't stored until user clicks a consent button, its enough to prove that infact no details are stored until clicking the consent button. And that having auditable consent records on server side (which in itself is personal details) is only required if the personal details are fetched from somewhere else. Jun 13 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.