Can a pre-ticked checkbox be used to RECALL/REVOKE consent under GDPR and/or ePrivacy/cookie law?

Question

I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?

I have made a specific consent function like this: When user first visit website and uses the functions, there is a empty consent checkbox: "Save my details in a cookie so I don't need to enter them everytime".

IF the user gives consent, checks the checkbox, and proceeds, the details are now saved in cookie.

Next time user visit website, the checkbox will now be pre-ticked (as the user previously given consent). If the user wants to revoke or recall the consent, the user can now uncheck the checkbox and proceed, and the cookie will be deleted.

Technically, it works by checking for presence of the said cookie, if cookie is present, box is pre-checked, else box is empty.

I wonder, is this valid consent according to GDPR, and is it permittable to use a pre-ticked checkbox to revoke/recall consent?

I see two legal problems with this: 1: If the user checks the checkbox, and then another user uses the same computer, or the user forgets he consented, the user could believe its an invalid consent as the box is pre-checked. 2: If GDPR law requires the revocation of consent be a separate function and not built-in the consent checkbox, it could be problematic.

Also, I wonder, if I use this scheme and totally locally controlling this function, it will mean that I as a website owner will NOT be able to revoke consent on behalf of the user, only way for the user to revoke his consent is to uncheck the checkbox or delete his cookies.

Is it valid to do this, or MUST I be able to revoke consent on behalf of a user if a user emails and wants to revoke consent, or can I refer user to uncheck that checkbox? Since the details is stored in a cookie, only way for me to revoke consent would be to somehow "ban" that cookie from being activated later on from the server side, requiring me to store personal details of users (either IP-adresses of computers which the cookies should not be respected from and immidiately deleted, or users email adress to "ban" the content of the cookie to be used, and immidiately delete all cookies containing that email adress)

Another thing is that since the function is locally controlled, it means that I don't know or store which users have consented, meaning I do not have any records of consent from users. HOWEVER, since the function is built in such a way that it will only place the cookie if consent is received, it would be sufficent as "consent proof" right?

Answer 1

The GDPR doesn't impose specific requirements on how consent may be revoked, other than that withdrawing consent must be as easy as giving it. If the original consent is given via a checkbox, and if that checkbox is compliant, then withdrawing consent through the same checkbox should also be compliant. It might be appropriate to regularly remind the user that they can withdraw consent, e.g. by expiring the cookie after 12 months. It could also be a good idea to indicate that the user enabled this themselves, e.g. by showing the timestamp when consent was given.

However, I am not convinced that consent is required in this scenario. While the definition of consent comes from GDPR, the cookie consent requirement comes from the ePrivacy directive which is then implemented in national laws. The ePD talks more generally about information stored on a terminal device of the "subscriber or user". Accessing such information (including but not limited to cookies) usually requires consent of the subscriber or user, but there is an exception for access that is strictly necessary for a service explicitly requested by the user to work. There are some consequences from this:

• You might not need consent for setting the cookie if such storage is strictly necessary for your website to work. If your site features a log-in you could in theory also store the information server-side, but client-side storage might actually be more privacy-friendly.

• At least, checking whether a consent cookie is set does not require consent since such access is strictly necessary for a consent mechanism to work.

• It is not a problem if multiple people share a browser profile. Since this is an ePrivacy issue, you do not need the consent of the data subject but the consent of the subscriber or user.

Cookie consent is typically managed purely client-side, and I have never heard of functionality for a website operator to withraw consent on behalf of the user. If a website operator is concerned about this, they could offer a link that goes directly to a consent management panel.

However, information about consent and withrawal events might be stored server-side. The GDPR requires that you can "demonstrate" that consent was given validly. For example, you should be able to show that the request for consent had enough information for the consent to be freely given, specific, and informed. Most cookie consent solutions also store a server-side timestamp for consent/withrawal events in order to have an auditable history that proves when consent was given or withdrawn. But unless there are user accounts, it's of course difficult to tie such events to a browser session.