I'm struggling to find any UX-specific guidance on the impact of GDPR - the new EU data protection regulation - coming into force May 2018.

From the reading I have done so far, I've identified use-scenarios such as:

  • consent to be expressed by clear affirmative action ("Silence, pre-ticked boxes or inactivity," however, is presumed inadequate to confer consent). I understand use of cookies, device IDs will be in scope

  • users have the right to withdraw consent at any time and “it shall be as easy to withdraw consent as to give it.”

  • the right of users to opt-out of their data being used for profiling (use of personal data to analyse or predict people’s performance, behaviour, situation, interests, location or movements)

  • right to be erased

  • right to portability

  • right to request data stored on user

Could anyone point to further reading or thoughts on how these changes will be solved for in terms of UI? At a basic level, for example, would the standard pattern for a cookie notification need to change, how might you make consent "as easy to withdraw consent as to give it"

Welcome thoughts from the community

  • Great question, please read my answer, I'm very interested in other people take on regulation. Let me know if you disagree with anything I said. Jun 20, 2017 at 21:36
  • From what I've seen so far it seems to be a UX disaster. The annoying "we use cookies" boxes now seem to come increasingly with "choices". It all fails the "don't make me think" test.
    – PhillipW
    Jun 16, 2018 at 18:47

2 Answers 2


I was reading through the regulation itself and opinions on it. I was thinking that by the end of my inquiry I can come up with UX guidelines. Nope, did not happened.

Here's are my takeaways:

You need a lawyer

You should listen to legal people of your organization on this issue. They should be accountable for interpretation of the regulation. The fine for not complying is up to 4% of global turnover. If you don't have legal team see what big boys do. See how Microsoft, Google, Facebook and as such. I'm pretty sure they take action, see some examples below.

Personal data

TL/DR: everything is personal data. Here is the language: "Any information which can identify or can be attributed to the person directly or using additional information". IP address, geolocation, salary (the number itself) if it can be connected to your identity - it is personal data.


Most important concept from UX perspective is a user consent, which is:

  1. freely given - means non-blocking unless you can prove that you can't provide service without the data. Good reason: email address for registration, bad reason: email for marketing campaign.
  2. specific - no bundling: email for sign up is one consent, newsletter is another.
  3. informed and unambiguous: should whom gets to process, what data, why and for how long.
  4. affirmative action: IMO it means there should be a checkbox or very clear notice (e.g. "enter email to receive newsletter from ...").


Cookies are personal data. Cookies notice should be changes because under GDPR implied consent ("By using this site ...") is not sufficient. It should be affirmative as any other consent. Here are some examples for europa.eu subsites. Presumably they should know how to cookie, but some on them are really confusing. enter image description here


For examples on how to provide user right see the following.

Here is example of newsletter subscription from one of EU websites

enter image description here Notice how specific the language of the consent is.

Further reading

I can recommend ICO'a website and guidelines. It is UK NPO and in my opinion, it is trustworthy.

To end on positive note, GDPR is a one-stop-shop. If you are cleared by one regulator in any UE country, you are good across entire EU (and UK … most likely)

And last thing: you should not take this as legal advice.

  • Thank you for your answer and nothing I disagree with. Like you I was hoping to be able to interpret the guidelines and make some recommendations on how UI components such as the cookie notification may need to change. I have some views or ideas on how UI may need but as you suggested I was curious what the big platforms would be doing as this may lead to establishment of conventions. Thus far I have not found anything. E.g., assuming personal information will now be an opt in, this will require a checkbox. Then assumption that UI will need to support the unchecking of this box at any point
    – tima
    Jun 22, 2017 at 11:39
  • I will add a caveat that lawyers typically cannot give black-and-white answers on design or implementation. The purpose of modern law is to be interpreted. What you will get in the best case is advice as to what they would feel comfortable arguing in support of should you be on the wrong side of a suit. This will mostly be based on precedent which, for new legislation, might be hard to come by. This is not to discourage anyone from seeking legal advice -- quite the opposite -- only to temper expectations of what that will provide: discussions, not decisions. Jul 22, 2017 at 16:37

Here are two great starting points on GDPR, UX & Marketing that i have found helpful myself:

GDPR: 10 examples of best practice UX for obtaining marketing consent

This article contains key UX focus points, inlcuding UI suggestions. Giving detailed insight into how to present the 'information management' options to users:

  • Unbundled: Consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service.
  • Active opt-in: Pre-ticked opt-in boxes are invalid – use unticked opt-in boxes or similar active opt-in methods (e.g. a binary choice given equal prominence).
  • Granular: Give granular options to consent separately for different types of processing wherever appropriate.
  • Named: Name your organisation and any third parties who will be relying on consent – even precisely defined categories of third-party organisations will not be acceptable under the GDPR.
  • Easy to withdraw: Tell people they have the right to withdraw their consent at any time, and how to do this. It must be as easy to withdraw as it was to give consent. This means you will need to have simple and effective withdrawal mechanisms in place.

GDPR UX prototypes

This site is showing prototypes on possible solutions. These ideas can help fasten your own design process

Important takeaway:

If you're just sending offers, dynamic content (nothing personalied on browsing behaviour) and you're not collecting, storing and processing ancillary data, then you simply need marketing consent, as is currently the case.

  • 1
    Can you copy and paste a little more into the answer - just in case the links fail after a while.
    – Mayo
    Nov 30, 2017 at 13:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.