首页>汉盛研究>汉盛法评>Cookies Walls以及滚动网页是否构成GDPR下的“明确同意”?

Cookies Walls以及滚动网页是否构成GDPR下的“明确同意”?

2020-05-14   李玉玲,Cédric

欧洲数据保护委员会(The European Data Protection Board, EDPB)于2020年5月4日通过了其最新的指南05/2020(《更新指南》),主要是就欧盟一般数据保护条例(“GDPR”)下的“明确同意”做了两方面的澄清。




在最新的《更新指南》中,主要是澄清了两方面的问题,即通过Cookies Walls的“同意”以及滚动网页的行为是否属于GDPR规定下的“明确同意”。

一、Cookies Walls

一般来说,Cookies Walls是一个弹窗,可以阻断数据主体对网页的使用直到数据主体同意使用Cookies来追踪数据主体的上网活动。


那么,在这种情况下就产生了一个问题。数据控制者能否能通Cookies Walls来限制数据主体对其网站的访问?例如,除非数据主体按下“接受Cookies”的按钮,否则数据控制者会封锁其网站的内容。

对于上述问题,目前《更新指南》指出,对服务和功能的访问不能以数据主体同意在其终端设备(所谓的Cookie Walls)中存储信息或获得对已存储信息的访问为条件。



《更新指南》确认,在通过“我同意”的可选(非预先勾选的)选项输入框内的勾选行为可以被视为 “明确的同意行为”。



The European Data Protection Board (“EDPB”) has adopted on 4 May 2020 their latest Guidelines 05/2020 (the “Updated Guidelines”) on consent under the EU Regulation 2016/679 (“GDPR”).

As a reminder, under GDPR, a data controller is only allowed to process the data of a data subject if certain conditions are met, one of them being when the data subject has given his/her explicit consent.
However, there have been discussions as to the very notion of “explicit consent”. The question is of importance, since consent can only be an appropriate lawful basis if a data subject is offered control and is offered a genuine choice with regard to accepting or declining the terms offered or declining them without detriment.
GDPR defines consent as “freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (Article 4(11) GDPR).
The Updated Guidelines are an updated version of the previous Guidelines adopted by the Article 29 Working Party on 10 April 2018 which were later endorsed by the EDPB.
The main clarifications in the Updated Guidelines were brought regarding the questions related to cookie walls” and the issue regarding scrolling and consent.
1. Cookie walls
GDPR indicates that, among others, bundling consent with acceptance of terms or conditions or tying the provision of a contract or a service to a request to consent to process personal data that are not necessary for the performance of that contract or service is considered highly undesirable. If consent is given is such way, it will be presumed as not having been given freely and it will therefore not be a lawful basis for a data controller to process data of a data subject.
The question was therefore raised whether a data controller was allowed to restrict access to their website subject to the acceptance of cookies. Such cases arises for example, if a data controller blocks content of his website, unless the data subject clicks of the “Accept cookies” button.
The Updated Guidelines confirm that access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls).
2. Scrolling and consent
The Updated Guidelines remind that the GDPR is clear that consent requires a statement from the date subject or a clear affirmative act, which means that it must always be given through an active motion or declaration. While the Updated Guidelines mention that the best “clear affirmative act” would be a written statement given by the data subject(e.g. letter or e-mail), it also admits that such formal way of giving consent might often not be realistic.
The Updated Guideline confirms that the active ticking of an optional (non pre-ticked) opt-in box mentioning “I consent” can be considered as a “clear affirmative act” to consent to the processing (Updated Guideline Example 14 paragraph 80).
Nevertheless, the Updated Guidelines indicate that data controllers have the liberty to develop a consent flow that suits their organization and physical motions may qualify as a clear affirmative action under GDPR.
Continuing the ordinary use of a website, is not considered as a clear affirmative act, as it cannot be distinguished from other actions.
Physical motions that may qualify as such may include (Updated Guidelines Example 16):
· swiping a bar on a screen,
· waiving in front of a smart camera,
· turning a smartphone around clockwise or in a figure eight motion
However, the Updated Guidelines consider that scrolling or swiping through a webpage or similar user activity will not under any circumstances satisfy the requirement of “clear and affirmative action” as they may be difficult to distinguish from other activities or interaction by a user.