Cookies - Should the toggles be on?

Question

I'm not sure if the details of the cookies, GDPR policies, should be on by default or not? Is it bad or just convenient for the company? And should I have a Reject All and Accept All?

Answer 1

As the most highly voted answer is simply false I am writing this answer just clarify the legalities in the EU.

Under GDPR there are 6 lawful bases for processing personal data. The two we care about are

• consent
• legitimate interest

Consent

Consent is something that is opt-in and allows a company to process personal data in nearly limitless ways. To counterbalance this however getting consent is fairly hard:

Consent must be freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis. The element “free” implies a real choice by the data subject.

Source: https://gdpr-info.eu/issues/consent/

And beyond that there is a bunch of requirements what constitutes a consent, most importantly it needs to be granular and clearly documented.

Legitimate interest

Conversely processing based on legitimate interests is opt-out, but requires a company to justify that the impact on the user is limited and allow the user to object

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Source: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/

Once again it comes with a lot of limitations though

At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.

Or as the UK's ICO puts it best:

[Legitimate interest as a lawful basis for processing] is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing. If you choose to rely on legitimate interests, you are taking on extra responsibility for considering and protecting people’s rights and interests.

Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/

Conclusion

Practically this means that you can do both opt-in's and opt-out's and the most important thing is that for each processing of personal data you individually evaluate whether you wish to process it based on legitimate interests or consent and individually expose each of those to the user. If you aren't able to do such a legal evaluation then just make everything opt-in and granular and you will be safe.

Answer 2

Simple answer, the law states that they must be off per default.

Privacy by default: https://www.ics.ie/news/what-is-privacy-by-design-a-default

Accept all/reject all buttons are a nice touch, go ahead and use that!

Answer 3

They should be off by default, AND there shouldn't be too many of them (max 3). There are some sites that do malicious compliance by giving EVERY SINGLE domain their site uses a separate toggle defaulted to on, which breaks the law and gives users that wish to disable them all a horribly designed user experience meant to just make them give up and allow everything.

Note that cookies that are necessary for core site behavior and do not contain personal data can be checked by default according to the GDPR. The GDPR says you cannot request or process personal data without prior consent, but cookies that are not personal data can legally be enabled by default.