These kinds of cookie banners are typically noncompliant and useless since they are not clear and provide too little information to users.
Careful: blocking a user who declines consent is usually a GDPR violation! Instead, only those aspects of the site that rely on this consent should be disabled.
When cookie consent is needed
Per the EU ePrivacy directive (PECR in the UK), information society services (websites, apps, …) are only allowed to store or access information on the end user's device if one of the following holds:
- the access or storage is strictly necessary for performing a service that was explicitly requested by the user; or
- the user has given consent
Note: there is no “legitimate interest” exception for cookies.
When is access/storage strictly necessary?
For example, it is strictly necessary for a photography app to store photos on a device. It is strictly necessary for a website to store session cookies so that you can log in to the site. It is strictly necessary for an ecommerce site to store the contents of your shopping cart. It is strictly necessary to remember cookie consent status. And so on.
It is not strictly necessary from the perspective of the user to have analytics cookies, ad personalization cookies, or cookies for features that the user doesn't actually use.
It is also worth noting that these rules apply regardless of whether the information being accessed/stored qualifies as “personal data”.
What consent is
Consent is defined in Art 4(11) and Art 7 GDPR, and further explained in EDPB guidelines 05/2020.
A defining feature of consent is that it must be freely given. The user must not suffer “detriment” for revoking or declining consent. And per Art 7(4):
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
This disallows making access to a service conditional on unrelated consent. For example, it would not be permissible for a website to exclude users who decline consent for advertising cookies. But:
- The EDPB guidelines discuss that there can be “permissible incentive” for consent. For example, courts and some DPAs seem to be of the opinion that a subscription website can offer free access to users that consented to personalized ads: consent-or-pay-walls can be compliant, whereas consent-walls alone would not.
- Sometimes consent is really needed for a processing activity, in which case it is OK to block that service until consent is given. For example, websites should not load third party content like YouTube videos or embedded maps until consent is given to share personal data with the third party. The rest of the website should still work, though.
If consent was not freely given, if the user didn't have an actual choice, then the consent is invalid.
What should the data controller in your scenario do?
The data controller should reassess the role of the cookies for which they are trying to ask for consent.
- If these cookies are strictly necessary from the user's perspective, then it is proper to inform the user about them – but this should not be confused with consent. It is my personal opinion that purely informational cookie banners are confusing/misleading and should be avoided, but this could also be argued differently.
Thus, more compliant cookie consent flows will typically give the user three options:
- continue with only strictly necessary cookies/purposes (must be default behaviour if none is selected)
- consent to all purposes
- configure purposes
For example, I'm fairly happy with the current Reddit cookie notice:
Why this is a good notice:
- it explains the data controllers (Reddit and partners)
- it summarizes the purposes for which consent is sought
- it links to more detailed information
- the presented options “accept all” an “reject non-essential” are less ambiguous that “accept/decline”
Comparing this with the list of minimum required information for informed consent in section 3.3.1 of the EDPB guidelines linked above, the following information is missing though:
- the identity of the “partners”
- what (type of) data will be collected and used
- the existence of the right to withdraw consent