GDPR - asking for consent indefinitely if respondent says no, until respondent say yes by exhaustion. Confirming choices allegedly forcing behaviour?

Question

Under EU regulation, GDPR concerns dealing of personal data and describes the different parties that are responsible for handling those data.

While navigating on the internet, a pop-up is prompted asking for consensus to the user to chose if or not grant permission to the vendors of Ads for collecting own data.

My experience is that each time I browse a site, say https://example.com, the pop-up appear, I manually tick no to all. I save my choices.

Whenever I will browse again the domain example.com, that confirmation of choices is asked all over again.

If I tick yes to all, the confirmation of my choices will not be asked anymore.

• Is there a legal basis to motivate that actions for confirmation of choices should be equal to both users' answer, otherwise creating a bias and forcing the user in accepting conditions opposed by its own choices, as a result of an "harassment" of repeated confirmation and blocking user experience ?

• Who is the responsible for the procedure of confirmation of choices, for a point of view of GDPR, since personal data are not yet collected ? E.g. is the vendor, the browser, Google.. which party and which role does the operator for confirming choices has with regards to GDPR ?

My desire is to find a way to actually protect users' choices, either remove the GDPR at all because, at the end, data are invasively collected anyway by platforms, GDPR is not efficacious is towards largest player (or the efficacy of GDPR is poorer for largest commercial platforms and asymmetrically much stronger for smaller companies) and the GDPR compliance is detrimental to user experience.

Answer 1

This doesn't sound very GDPR-compliant, but the GDPR provides insufficiently concrete guidance.

Consent as defined by the GDPR must be freely given. If dark patterns are applied to coerce the user towards giving consent, this calls into question whether the consent would be valid. For example, nagging the user with a popup on each page might not be compliant. Instead, the website should remember the consent status (whatever choice the visitor made), and revisit this consent status regularly. For example, a site might ask the user every couple of months whether they've changed their mind.

The GDPR does say that withdrawing consent must be as easy as giving it. But it doesn't say anything about declining consent in the first place. In practice, this requirement together with concerns about free decisions means that supervisory do expect declining consent to be as easy. For example, if a consent dialog has an “accept all” button, there should also be a “reject all” button.

Sometimes, repeated consent nagging is motivated not by malicious intent but by a misunderstanding of cookie consent requirements. The cookie consent requirement stems from the 2002 ePrivacy directive. It says that access to or storage of information on the end user's device needs consent, unless that access/storage is strictly necessary for a service explicitly requested by the user. Cookies and similar technologies store information on the end user's device, so that consent is needed for all non-essential cookies.

But this also means that no consent is required for truly essential cookies, such as for implementing browser sessions, security tokens, storing user preferences, and storing cookie consent. When the user decides to decline cookie consent, it is still permissible (and arguably even mandatory) to set a cookie to remember that decision.

Responsible for collecting consent is the “data controller”, but in some situations there might be multiple data controllers making responsibilities murky. However, case law such as from the Fashion ID case clearly show that the website operator is a data controller for everything that happens in the website, so they can always be held liable. If the website operator shares personal data with third parties, the operator needs a legal basis to do that – often, consent. It is the website operator who decides whether to integrate a third party tool, so the website operator is responsible for having a legal basis for resulting data sharing. However, the website operator is not necessarily responsible for what the third party subsequently does with the personal data.

You are concerned that no data controller might exist when no personal data was yet collected. I think this is wrong on two grounds. (1) Whether someone is data controller for a processing activity hinges on whether they determined the purposes and means of processing, not whether the processing activity was already conducted. Also, processing describes more activities such as collection. (2) Every website necessary involves the processing of personal data such as IP addresses. This is also why merely loading assets (images, media, JavaScript files, …) from third parties will need a legal basis, such as consent before the content is loaded