Severe Criticism from the Danish Data Protection Agency of a Website with a Consent Setup which was found not to be sufficiently clear

Background

In January 2021, the Agency initiated investigations on a particular Danish website after having received a complaint from a data subject regarding the website’s processing of personal data.

The website was set up with the following two consent solutions:

Firstly, users were presented with information that data would be stored and processed from visitors on the website. From this presentation, the user could choose between “Read more about cookies” or “Close”. The setup did not offer the user to reject consent”.

Secondly, another setup on the website informed the users about the purpose of the processing of data. From this presentation, the user could choose between “Accept specific purposes” or “Accept All”. However, due to the visual appearance of the website, the users were predominantly guided towards the “Accept All”.



Decision from the Agency

The Agency found that the website’s consent solutions did not fulfil the requirements stipulated in articles 5 and 6 of the GDPR.

It is a fundamental requirement that consent shall be a (1) freely given, (2) specific, (3) informed, and (4) unambiguous indication of intention. The Agency used these conditions to investigate the lawfulness of the website’s different consent solutions.

The Agency further specified the definition of consent by referring to a decision from the Court of Justice of the European Union (case C-673/17) in which the Court of Justice in premise 72 states that consent should be given by a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. According to the Court of Justice, this could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. On the other hand, silence, pre-ticked boxes, or inactivity does not constitute legal consent.

Because data subjects did not have the opportunity to reject the consent of any of the different sorts of data processing with the solution used before January 2021, the Agency found that the consent solution did not fulfil the requirements of consent being freely given and specific. Moreover, the consent did not involve any active action, which indicated that the consent was silent and therefore not an unambiguous indication of intention.

The Agency concluded that the consent solution could not be seen as lawful, and it found grounds for expressing severe criticism of the website’s processing of personal data based on the website’s visitors until the beginning of January 2021.

For the first part of the investigation, the Agency found that users were not given the possibility to choose between processing activities and the website did not allow for users to reject to consent. Based on this the Agency issued severe criticism of the handling of personal data on the website.

For the second part of the investigation, the Agency found that the visual setup directed users towards the “Accept All” button and it was more difficult for users to find out how to reject a consent than to accept. Based on this, the Agency issued criticism of the handling of personal data on the website.

The Agency issued a further severe criticism as the investigation revealed that data was in fact collected for certain purposes, even before the user had provided the consent.



Our Comments

The decision from the Agency illustrates that setting up a correct consent solution should continuously be a focus area for professionals.

The decision once again confirms that proper consent must be a freely given, specific, and unambiguous indication of intention. This case provides a valuable insight into how consent could be designed in practice.

In this respect, it is particularly interesting that the Agency does not find that the options "Accept" and "ACCEPT ALL" give the data subject a sufficiently transparent impression of the options for rejecting cookies. Many websites operate with the two options "Accept selected" and "ACCEPT ALL". Such solutions should be used with care, especially if there is a difference in the visual design and appearance of the two buttons.

Furthermore, it is notable that the Agency also ensures the visual expression of the different consent buttons – the crucial takeaway is that both the consent and the rejection/limited consent shall have the same layout and visual position.