Under EU regulation, GDPR concerns dealing of personal data and describes the different parties that are responsible for handling those data.

While navigating on the internet, a pop-up is prompted asking for consensus to the user to chose if or not grant permission to the vendors of Ads for collecting own data.

My experience is that each time I browse a site, say https://example.com, the pop-up appear, I manually tick no to all. I save my choices.

Whenever I will browse again the domain example.com, that confirmation of choices is asked all over again.

If I tick yes to all, the confirmation of my choices will not be asked anymore.

  • Is there a legal basis to motivate that actions for confirmation of choices should be equal to both users' answer, otherwise creating a bias and forcing the user in accepting conditions opposed by its own choices, as a result of an "harassment" of repeated confirmation and blocking user experience ?

  • Who is the responsible for the procedure of confirmation of choices, for a point of view of GDPR, since personal data are not yet collected ? E.g. is the vendor, the browser, Google.. which party and which role does the operator for confirming choices has with regards to GDPR ?

My desire is to find a way to actually protect users' choices, either remove the GDPR at all because, at the end, data are invasively collected anyway by platforms, GDPR is not efficacious is towards largest player (or the efficacy of GDPR is poorer for largest commercial platforms and asymmetrically much stronger for smaller companies) and the GDPR compliance is detrimental to user experience.

  • There's one technical issue here: If you say "no to all" and the website really respects that, it won't save any cookies, and therefore cannot remember your choice.
    – PMF
    May 22, 2022 at 10:11
  • 4
    @PMF consent is only required for those cookies that aren't strictly necessary for a service explicitly requested by the user. It is perfectly fine to store a cookie to remember the user's decision to decline non-essential cookies.
    – amon
    May 22, 2022 at 12:03
  • 1
    Google was fined in France because they made rejecting consent more difficult than rejecting consent. Asking for consent in perpetuity would undoubtedly also make rejecting consent more difficult than giving consent, so would be likewise illegal. However this is not an answer to your question, because you ask about the GDPR, and this was an ePrivacy issue, not a GDPR issue. techcrunch.com/2022/01/06/… May 22, 2022 at 12:43
  • Indeed @EikePierstorff relevant because I wonder who must comply with the practice of making giving or rejecting consent of equal "cost". In my browser I m setting restrictions and can testify that there are only units of sites asking for consensus only once. But never heard of fines. Also, are fines adequate enough? Who is the agent of this practice: Google (via the browser), the webdomain or site (e.g. MS teams asking for giving permissions to a bunch of Microsoft owned websites), the Ads platforms (OneTrust, Amazon affiliate and others, or the small organisations affiliated to them?
    – user305883
    May 23, 2022 at 19:48
  • 1
    @user305883 Strictly speaking yes. If the website really stores no cookies, it cannot detect whether you are visiting for the first time or not. Whether a cookie just for that would go under "strictly necessary" can probably be disputed, because as you say, it could already be used for tracking.
    – PMF
    May 23, 2022 at 19:58

1 Answer 1


This doesn't sound very GDPR-compliant, but the GDPR provides insufficiently concrete guidance.

Consent as defined by the GDPR must be freely given. If dark patterns are applied to coerce the user towards giving consent, this calls into question whether the consent would be valid. For example, nagging the user with a popup on each page might not be compliant. Instead, the website should remember the consent status (whatever choice the visitor made), and revisit this consent status regularly. For example, a site might ask the user every couple of months whether they've changed their mind.

The GDPR does say that withdrawing consent must be as easy as giving it. But it doesn't say anything about declining consent in the first place. In practice, this requirement together with concerns about free decisions means that supervisory do expect declining consent to be as easy. For example, if a consent dialog has an “accept all” button, there should also be a “reject all” button.

Sometimes, repeated consent nagging is motivated not by malicious intent but by a misunderstanding of cookie consent requirements. The cookie consent requirement stems from the 2002 ePrivacy directive. It says that access to or storage of information on the end user's device needs consent, unless that access/storage is strictly necessary for a service explicitly requested by the user. Cookies and similar technologies store information on the end user's device, so that consent is needed for all non-essential cookies.

But this also means that no consent is required for truly essential cookies, such as for implementing browser sessions, security tokens, storing user preferences, and storing cookie consent. When the user decides to decline cookie consent, it is still permissible (and arguably even mandatory) to set a cookie to remember that decision.

Responsible for collecting consent is the “data controller”, but in some situations there might be multiple data controllers making responsibilities murky. However, case law such as from the Fashion ID case clearly show that the website operator is a data controller for everything that happens in the website, so they can always be held liable. If the website operator shares personal data with third parties, the operator needs a legal basis to do that – often, consent. It is the website operator who decides whether to integrate a third party tool, so the website operator is responsible for having a legal basis for resulting data sharing. However, the website operator is not necessarily responsible for what the third party subsequently does with the personal data.

You are concerned that no data controller might exist when no personal data was yet collected. I think this is wrong on two grounds. (1) Whether someone is data controller for a processing activity hinges on whether they determined the purposes and means of processing, not whether the processing activity was already conducted. Also, processing describes more activities such as collection. (2) Every website necessary involves the processing of personal data such as IP addresses. This is also why merely loading assets (images, media, JavaScript files, …) from third parties will need a legal basis, such as consent before the content is loaded

  • 1
    It seems to be accepted that declining consent is more complicated than granting it, as everybody does it that way. The "accept all" button is always more visible than the "show settings" button, and even if you go to the settings page, you still have to care to click "save" and not "accept all".
    – PMF
    May 22, 2022 at 14:47
  • 2
    @PMF The collective understanding of the GDPR has evolved over time. Industry is currently in the process of accepting that a three-option “accept all/reject all/more options” approach is the way to go. For example, Google rolled out such consent settings a few weeks ago, due to pressure from supervisory authorities.
    – amon
    May 22, 2022 at 15:21
  • That's great news, indeed.
    – PMF
    May 23, 2022 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .