Most websites are asking their users to consent to cookies with the following wording: “By continuing to use our site, you accept our use of cookies.” With GDPR the question arises, whether this kind of consent is still compliant.

1. Legal background

Cookies are admissible as long these are strictly necessary to provide the service. That derives from Art. 5 (3) directive 2002/58/EC – known as “ePrivacy directive”.¹

E.g. a cookie for a shopping cart is necessary for the service of an online shop. The shopping cart provides the customer with the option to buy several items within one technical process. Without the cookie the customer would be forced to start the whole buying process for each item form zero.²

In contrast convenience cookies, marketing cookies and tracking cookies are not strictly necessary for the provision of the service. E.g., a tracking cookie which is permanently placed on the hardware device and follows the customer across all websites is not necessary for an online shop. Therefore, convenience cookies, marketing cookies and tracking cookies require the consent of the customer.

EPrivacy directive orginately referred to Data Protection Directive 95/46/EC on how to ask for consent according to Art. 2 (f).³ Data Protection Directive 95/46/EC is now replaced by GDPR. That leads to the question, whether the wording “By continuing to use our site, you accept our use of cookies.” is still admissible under GDPR.

2. Assessment

According to Art. 7 GDPR a consent shall be

1. freely given,

2. by a clear confirmative action,⁴

3. without being conditional for personal data that is not necessary for the performance of the service contract.

First, the consent is not freely given since the user has no choice to use the service with or without the convenience cookie. The option for the customer is soley, “take the service with cookie or leave it”.

Second, the user is not able to express his will in case he refuses to consent to the cookie and at the same time likes to purchase goods from the online shop. Therefore, the online shop receives a confirmation from its customers which is ambiguous.

Third, the consent is conditional since the data which is being processed by the convenience cookie is not strictly necessary for the provision of the service. The provision of the service is possible without the implementation of the convenience cookie. Without convenience cookie the online shop is less user friendly. But the purchase of the items is still possible. Therefore, the convenience cookie is not strictly necessary to provide the service. It follows that the customer is forced to consent if he wants to purchase goods from the online-shop. Therefore, the consent is conditional.

In addition a seperate consent is neccessary for every single purpose of consent.⁵ E.g. the consent for a convenience cookie has to be seperated from a consent for a tracking cookie e.g. in a seperate tick-box.

3. Conclusion

The wording which is mentioned above represents a “pseudo-consent”. The user has no choice to use the online-shop without the cookie for convenience, marketing or tracking purposes. That approch is not in line with the aspect of selfdetermination, which is the essence of the Rigth to Data Protection.

In a similar case the German High Court (Bundesgerichtshof) asked the ECJ for a preliminary ruling on consent. The Court aked whether a consent with a pre-ticked box is admissible according to Art. 5 (3) ePrivacy Directive in connection with GDPR.⁶ The pre-ticked box is an opt-out instead of an clear confirmative action which requires an opt-in according to Recital 32 GDPR. Therefore, it is very likely that the ECJ dismisses this kind of consent. However, the ECJ may take this proceeding as a chance to clearify the requirements for consent according to GDPR in a broader sense.