On May 4, 2020, the European Data Protection Board (the "EDPB") adopted the "Guidelines 05/2020 on consent under Regulation 2016/679" (the "EDPB Guidelines"). The Guidelines are a revised version of the Article 29 Working Party guidelines on the same topic (the "WP29 Guidelines"), which were already endorsed by the EDPB on April 18, 2018.1

The revisions primarily address the (non)validity of consent in cases of cookie walls, as well as the fact that scrolling down or swiping through webpages cannot be considered as providing valid consent.

  • Cookie walls. The EDPB Guidelines now provide a specific example in relation to cookie walls in the section dealing with the "conditionality of consent." The EDPB Guidelines clarify that allowing content of a website to be visible only upon the condition of receiving consent from the visitor for the placement of cookies is not an option for obtaining valid consent under GDPR.
  • Scrolling or swiping. The EDPB Guidelines add that "under no circumstances" can scrolling or swiping meet the requirements of a clear and affirmative action and therefore provide a valid consent. Building on the WP29 position, the EDPB acknowledges that mere scrolling may be difficult to distinguish from other actions or interaction by a user, which makes it even harder to demonstrate that an unambiguous consent has been given. Adding to what was said in the WP29 Guidelines, the EDPB underlines that such situations would make it difficult to provide a way to withdraw consent in a way "as easy" as that in which the initial consent was given (another aspect of valid consent under GDPR).

Persistent misconceptions pointed out by the recent report issued by the Irish Data Protection Commissioner2 or the recent spread of cookies and consent guidelines issued by national supervisory authorities3 could explain why the EDPB decided to revisit its previously issued guidelines. The fact that the EDPB is engaging in such path should be praised; we consent for the EDPB to pursue and will continue to browse its website to look up for more; "undoing" and "redoing" is still working.

Footnotes

1. For our insights on the WP29 Guidelines, check out our previous Legal Update.

2. For our insight on that report, check out our previous Legal Update.

3. See for example, the recently issued guidelines by national supervisory authorities from Ireland, Greece, Belgium, Denmark, Spain, Germany, France, the UK or the Netherlands.

Article originally published on 7 May 2020

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe - Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© Copyright 2020. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.