36

I'm not sure if the details of the cookies, GDPR policies, should be on by default or not? Is it bad or just convenient for the company? And should I have a Reject All and Accept All?

enter image description here

  • 10
    When in doubt, ask your company's lawyer, or legal department. – maxathousand Feb 27 at 21:16
  • 9
    I believe that I'm not the only one conditioned to running like hell away whenever I see the lie we value your privacy. – Pavel Feb 28 at 7:51
21

As the most highly voted answer is simply false I am writing this answer just clarify the legalities in the EU.

Under GDPR there are 6 lawful bases for processing personal data. The two we care about are

  • consent
  • legitimate interest

Consent

Consent is something that is opt-in and allows a company to process personal data in nearly limitless ways. To counterbalance this however getting consent is fairly hard:

Consent must be freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis. The element “free” implies a real choice by the data subject.

Source: https://gdpr-info.eu/issues/consent/

And beyond that there is a bunch of requirements what constitutes a consent, most importantly it needs to be granular and clearly documented.

Legitimate interest

Conversely processing based on legitimate interests is opt-out, but requires a company to justify that the impact on the user is limited and allow the user to object

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Source: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/

Once again it comes with a lot of limitations though

At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.

Or as the UK's ICO puts it best:

[Legitimate interest as a lawful basis for processing] is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing. If you choose to rely on legitimate interests, you are taking on extra responsibility for considering and protecting people’s rights and interests.

Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/

Conclusion

Practically this means that you can do both opt-in's and opt-out's and the most important thing is that for each processing of personal data you individually evaluate whether you wish to process it based on legitimate interests or consent and individually expose each of those to the user. If you aren't able to do such a legal evaluation then just make everything opt-in and granular and you will be safe.

  • 2
    And one last thought, I build consent management interfaces for two companies (one of which was a fortune 500 company) and understanding all the rules is a fair bit of work, so either find a lawyer to talk to or find the time to properly study the original GDPR texts themselves, because a lot of misinformation is spread by people who have simply heard something. – David Mulder Feb 28 at 12:31
48

Simple answer, the law states that they must be off per default.

Privacy by default: https://www.ics.ie/news/what-is-privacy-by-design-a-default

Accept all/reject all buttons are a nice touch, go ahead and use that!

  • 11
    This is false. "The law" - the GDPR - states that legitimate interests can be a valid basis for the processing of personal data. Legitimate interests can however be objected to which in the case of most companies is as simple as toggling off a toggle. – David Mulder Feb 28 at 12:18
4

They should be off by default, AND there shouldn't be too many of them (max 3). There are some sites that do malicious compliance by giving EVERY SINGLE domain their site uses a separate toggle defaulted to on, which breaks the law and gives users that wish to disable them all a horribly designed user experience meant to just make them give up and allow everything.

Note that cookies that are necessary for core site behavior and do not contain personal data can be checked by default according to the GDPR. The GDPR says you cannot request or process personal data without prior consent, but cookies that are not personal data can legally be enabled by default.

  • 1
    Like Yahoo/Oath's cookie policy ? – breversa Feb 28 at 14:08
  • You can process data without the subjects consent. Consent is just one of eight bases for processing. – Richard Ward Feb 28 at 14:52
  • And the toggles on those sites are designed to be maximally unclear as to whether they are on or off – ratchet freak Feb 28 at 15:19
  • 2
    Worse are the ones where you have a list of about 200, where maybe half have toggles - the rest require you to go to their site, find where the heck the settings are, possibly log in (create an account? to stop tracking? what.) and change them there. only have to do it 100 times for every new site you go to. Screw that, third party scripts blocked by default, and cookies blocked if they are not white-listed. – Baldrickk Mar 1 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.