Article 4a ePrivacy Regulation – Consent

To be valid, consent must  be declared by the ‘end-users concerned’.^[27] In short, an end-user is a natural or a legal person using or requesting an electronic communications service.^[28] However, determination solely on the basis of who has requested a service does not always allow for an unequivocal identification of the correct end-user, i.e. the person who is responsible and entitled to declare consent. There are constellations where multiple persons may have an interest in the confidentiality of communications or the integrity of a device:^[29] A communication process often requires multiple participants whose privacy interests could potentially be threatened.

Example: Employee and employer both might have an interest in the confidentiality of communications on a work-computer or phone.

It is conceivable that in specific cases the communicating parties have diverging interests regarding their privacy. This gives rise to the question on how the interests of multiple concerned parties shall be considered and evaluated when processing is at the disposal of one end-users’ consent, such as in the case of Art. 6b Sec. 1 lit. c) ePrivacy Regulation. In such a situation, it is necessary to determine whose interest is decisive. Generally, if only one party is requesting or using a service, this party will be considered the only relevant end-user whose consent the service provider must obtain. For the processing of electronic communications content, Art. 6a Sec. 1 lit. b) provides that, in principle, all parties involved in the communication must consent (Art. 6 para. 17 et seqq). However, there are a number of borderline cases that can be problematic.

Firstly, there are situations where both, a natural and a legal person are involved on one side of a communication process. The definition in the EECC Directive and the ePrivacy Regulation explicitly state that legal persons, too, can be considered end-users.^[30] Therefore, where a legal person requests a service, it is, by definition, an end-user of this service. However, legal persons usually require individuals to represent and act for them. An individual using a service is potentially also an end-user, even if a legal person requested the service. Hence, there are two relevant players involved: the legal person, whose interests lie in the protection of their business secrets, and the individual acting on behalf of that legal person, whose interest will be to ensure the greatest possible degree of privacy and confidentiality of communications. Both can, but do not necessarily have to be congruent.

Since service and network providers rely on some form of involvement with end-users, they must be able to determine who their relevant end-user in terms of ePrivacy compliance are. In order to identify their users, providers consequently require the definition of objective criteria. In the context of the provision of electronic communications services and networks, the end-user ought to be the person to whom a certain service is provided to. In most cases, this will be the party subscribing to a service, which will usually be the legal person itself and not the natural persons using the service. However, during the legislative process, there have been proposals to grant individuals, particularly employees, an autonomous right to decide whether they want to consent to certain measures, even if it was their employer who subscribed to the service.^[31]

Secondly, multiple individuals may potentially use a single device. This poses a problem, since privacy preferences of one end-user do not necessarily reflect another end-user’s preferences and interests. Therefore, interests of more than one end-user may have to be taken into account. As mentioned above, the identification of the relevant end-user who is authorised to declare consent for each particular processing activity can be tricky in particular when providers base their processing activities on consent. Thus, as in the scenario above, objective criteria in order to determine the respective end-user are required. As a rule of thumb, where multiple persons are concerned, the identification of the relevant end-user is generally determined on the basis of contractual relationships.

[27] See Art. 6b Sec. 1 lit. c) and recital 16b ePrivacy Regulation.

[28] For a detailed definition see Art. 4 No. I.2.e).

[29] The integrity of a device is protected by Art. 8 ePrivacy Regulation, see Art. 8 para. Xx.

[30] Art. 4 No. I.1.e).

[31] Council of the European Union, ST 12293/19, p. 22 et seq.

Consent needs to be given freely, which is not the case if the end-user has no genuine and free choice, feels compelled to consent or is unable to refuse or withdraw consent without detriment.^[32] Under these circumstances, consent will be invalid.^[33] The most obvious cases of involuntary provision of consent due to detriment are cases of deception, intimidation, coercion and negative consequences, such as cost for the withdrawal of consent.^[34] In the event of a dispute, it is up to the controllers under the GDPR and the respective service or network providers under the ePrivacy Regulation to prove that no such detriment exists.^[35]

a)  Clear imbalance

In the context of the GDPR, consent is considered involuntary and thus inapt to serve as a legal basis for data processing where there is a clear imbalance between the data subject and the controller.^[36] This applies under the ePrivacy Regulation in relation to imbalances of power between the end-users and service or network providers. Imbalance of power refers to situations with asymmetric bargaining powers of the parties or social relationships of dependence. The decisive factor is whether the power imbalance has had an effect on the decision to provide consent by the end-user.

Consent can be effective despite asymmetric bargaining powers if this imbalance is not reflected in the concrete situation in which it was obtained. This is the case, for example, when the processing is in the interest of the end-user or when the end-user does not have to fear any disadvantages in case of refusal. It is therefore decisive whether the provider engages in an abusive exploitation of the request for consent.

An inappropriate imbalance of power will often exist in cases where the service providers are public authorities or where there is an employment relationship between end-user and the provider.^[37] These are particularly obvious examples for lack of voluntariness.^[38]

As regards public authorities, it is generally assumed that there are other, more appropriate legal bases than consent to rely on for processing and, thus, these alternative legal bases shall be primarily considered. Despite this general consideration, consent is not excluded absolutely as a legal basis for public authorities.^[39]

Example: A local municipality is planning road maintenance works. As the road works may disrupt traffic for a long time, the municipality offers its citizens the opportunity to subscribe to an email list to receive updates on the progress of the works and expected delays. The municipality makes clear that there is no obligation to participate and asks for consent to use email addresses for this (exclusive) purpose. Citizens that do not consent will not miss out on any core service of the municipality or the exercise of any right; they are able to give or refuse their consent to this use of data freely. All information on the road works will also be available on the municipality’s website.^[40]

In the latter example, there is clearly no abuse of power by the public authority and, thus, no reason to assume consent was given involuntarily. Similarly, in the context of the ePrivacy Regulation, it must be possible to rebut the general presumption of an imbalance of power in the case of public providers. If there are reasons against a superiority of public providers or a dependency of the end-users, these should be taken into account. This will be particularly relevant in the context of the ePrivacy Regulation as it does not provide for legal bases corresponding to Art. 6 Sec. 1 lit. c) and lit. e) GDPR, which by public authorities can refer to.

In the employment context, there is typically a relationship of dependency between employer and employee.^[41] When employees are also end-users with their employers being their providers, the question necessarily arises as to whether, here, declarations of consent can be obtained voluntarily at all. Employers who operate as service providers are therefore generally advised not to rely exclusively on consent as a legal basis. ^[42]

However, consent is not excluded as a valid legal basis in an employment context per se. It is noteworthy that the legislator decided not to include the employment relationship as a statutory example of clear power imbalance under the GDPR, although such inclusion was proposed in an earlier draft.^[43] Accordingly, the EDPB also acknowledges the general possibility for employers to demonstrate that consent of their employees was given freely and that employees were not pressured to provide consent.^[44] Thus, a case-by-case assessment will have to take place in order to determine validity of the consent. The threshold for employers to demonstrate the voluntariness of their employees’ consent will arguably be high.

b)  Condition for the performance of a contract

According to Art. 7 Sec. 4 GDPR, another factor to be taken into account when assessing voluntariness of consent is whether the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data which is not necessary for the performance of that contract.^[45] Thus, Art. 7 Sec. 4 GDPR sets out a prohibition on makeing a contractual performance conditional upon the provision of consent (‘take it or leave it-scenarios’).^[46] Within the ePrivacy Regulation, the same should apply with regard to electronic communications data that is unnecessary for the performance of a contract between the end-user and service or network providers.

Art. 7 Sec. 4 GDPR indicates that service or network providers should avoid to ‘bundle’ consent with the acceptance of terms and conditions or to ‘tie’ the provision of a contract or a service to a request for consent to process personal data which is not necessary for such provision.^[47] However, the actual scope of Art. 7 Sec. 4 GDPR is not entirely clear. Some understand it as a general prohibition of such ‘bundled’ consent,^[48] while others advocate for a limited application, with regard to essential services only,^[49] or only in relation to providers holding a monopoly position.^[50] However, the wording of Art. 7 Sec. 4 GDPR as well as its corresponding Recitals 42 and 43 do not provide for such narrow interpretation.^[51]

The EDPB, in turn, interprets Art. 7 Sec. 4 GDPR in conjunction with Recital 43 GDPR to stipulate a presumption of invalidity of consent obtained in contractual context for such ‘unnecessary’ data processing.^[52] Moreover, it identifies the main purpose of the provision is to ensure that the relevant data is not exploited as consideration for the fulfilment of a contract and that the two legal bases of contract and consent are not ‘merged and blurred’.^[53] It highlights that Art. 7 Sec. 4 GDPR neither applies as an absolute prohibition of ‘bundled consent’, nor is there a necessity for a restrictive application of this provision.[54] However, the EDPB concludes that cases will be highly exceptional and rare where valid consent is provided for not strictly necessary data processing activities within a contractual context.^[55]

The burden of proof imposed on the controller in Art. 7 Sec. 1 GDPR, which in the case of the ePrivacy Regulation applies to the service or network providers in a similar manner, also extends to the voluntariness of the declaration of consent. In conjunction with the presumption of invalidity of consent declarations in Recital 43 GDPR, it may therefore be difficult to demonstrate that consent was provided voluntarily despite being obtained in a contractual context.^[56]

aa) Consent provided as a form of remuneration

Cases where data subjects are given a choice between acquiring a service for a reasonable consideration, such as a fee, and acquiring it ‘free of charge’ in return for a declaration of consent, could be exempt from Art. 7 Sec. 4 GDPR if the choice relates to a genuinely equivalent service.^[57] The consent provided in such cases could be qualified as an option instead of a real condition for the performance of a contract and, thus, might be considered voluntary.^[58]

However, a service must not be denied entirely if an end-user refuses to provide consent, e.g. refusal to accept cookies or other tracking mechanisms when accessing a website. Rather, the end-user must be given an opportunity to refuse consent and still access the content of a website, e.g. in return for a reasonable remuneration, as otherwise there is no ‘genuine choice’ and consent is therefore unlawful.^[59] This requires website operators to inform their end-users about the possibility to refuse consent and still obtain access the services of the website. They may not be merely refer to equivalent alternative third-party services. According to the EDPB, the freedom of choice cannot depend on the offer of third market participants, which lies outside the controller’s sphere of influence.^[60] Rather, the equivalent service must be offered by the same provider or its organisation to which non-consenting end-users have access to.^[61]

Thus, business models that offer ‘free’ services in exchange for consent to data processing activities are not necessarily unlawful, as long as an alternative in exchange for a reasonable consideration is provided.^[62] However, where the alternatives provided by the service providers are designed in a way that end-users factually have no other option than consenting to the processing, e.g. where the service provider exploits a dominant position of power, no ‘voluntary’ consent can be provided.^[63]

bb)  Consent in return for the provision of essential services

Art 7 Sec. 4 is of particular importance in connection with ‘essential services’. Art. 7 Sec. 4 GDPR cannot be considered to be limited to such cases. , But it will be a strong indicator for unlawful conditionality of consent if it is provided in order to gain access to essential services. Essential services are generally services that are crucial to the organisation of daily life for the person giving consent, such as basic utilities like electricity, water or heat. However, in the digitzed society, essential services are no longer limited to such basic services. Consequently, Recital 18 further identifies basic broadband internet access and voice communications services as essential services within the ePrivacy Regulation, as these services are indispensable for individuals in order to manage their everyday lives in the digital economy and enjoy its benefits. Therefore, the ePrivacy Regulation goes on that in the context of such services, it cannot be assumed that a declaration of consent is made voluntarily if the end-user is not given the opportunity to refuse such consent without detriment.^[64]

When assessing whether an electronic communications service constitutes an essential services within the framework of the ePrivacy Regulation, it must be taken into account that reliable access to electronic communications services is generally of high importance in a digitized society. Most people rely on electronic communications in connection with their work, their own business or the maintenance of social and family contacts. Thus, end-users will usually be willing to accept higher privacy risks in order to be able to use these vital services. The explicit reference to voice communications and broadband internet access in Recital 18 should therefore be understood as indicative. While these types of electronic communications services are particularly fundamental, they do not necessarily constitute the only category of essential services.^[65]

cc)  Necessity of processing for the performance of a contract

In addition to single use cases that can be categorised as cases where voluntariness seems rather questionable, it will be decisive whether the data concerned by the declaration of consent are relevant or unnecessary for the performance of the respective contract in order to establish whether a request for consent falls under Art. 7 Sec. 4 GDPR. Necessity in this regard is to be understood in line with the interpretation of Art. 6 Sec. 1 lit. b GDPR. According to the considerations of the Art. 29 WP and the EDPB, the requirement of necessity for the performance of a contract is to be interpreted strictly. This means that the intended processing must be genuinely necessary for a purpose that is crucial for the performance of the contract, e.g. processing of address details in order to deliver goods or of credit card details in order to facilitate a payment.^[66] In turn, processing which is only useful but not objectively necessary to perform a contractual service will fall under the provision of Art. 7 Sec. 4 GDPR.^[67]

3. Specific and granular

It follows from the basic principles of the GDPR laid down in Art. 5 Sec. 1 lit. b), that it is indispensable to determine a specific processing purpose in order to lawfully process data. If data processing is to be carried out on the basis of a declaration of consent, this consent must clearly and specifically refer to the respective predetermined purpose in order to meet the requirement of ‘specificity’ set out by Art. 4 No. 11 GDPR.^[68] The data processing is then also bound to this purpose, unless another legal basis applies (principle of purpose limitation).^[69]

The requirement to obtain specific consent is closely linked to the requirement of ‘granularity’, which is considered to be necessary for the voluntariness of consent, i.e. that end-users must be able to consent to specific processing operations for specific purposes and in turn be enabled to opt-out of particular operations.^[70] Thus, providers will not be able to lawfully obtain consent for undefined processes and purposes through an all-or-nothing approach. Rather, they are required to obtain specific consent for all envisaged purposes.^[71] It follows from the requirement of specificity that consent cannot be obtained in form of a general authorisation.^[72]

Example: Entity M runs a web-based email service via the internet. For this purpose, M collects and stores electronic communications metadata. M sells digital advertising spaces on its webpage to third entities. These entities carry out behavioural advertising. When signing up to the email service, users have to consent to the use of their electronic communications metadata for behavioural advertising in order to successfully register with the email service.

In this example, M must inform its users of the different purposes of processing (running the email service + behavioural advertising) before obtaining consent. M’s users might feel obliged to consent to behavioural advertising in order to use the email service. M is required to put the users in a position to give free and specific consent to receiving behavioural advertising, independently of their access to the email service. For this purpose, M could use a pop-up window that informs users of all intended processing purposes and provides for a possibility to select the use of data to which they wish to consent and should inform them on the consequences of refusal of consent for certain kinds of processing activities, such as behavioural advertising.^[73]

The challenge of consenting to multiple processing operations and for multiple processing purposes arises frequently with respect to the use of cookies, as operators often want to use different cookies for different purposes (e.g. cookies that enhance the user experience of the website as well analytical cookies). Where multiple purposes are pursued, said information has to be given for each purpose. Consent must not be obtained en bloc but in a granular way that allows the end-user to limit his or her consent to particular purposes. This requires adequate information for end-users about their different options. If, for example, so-called cookie banners are used to obtain consent, it will not suffice if there is only one button indicating ‘accept cookies’. Rather, end-users should be provided the opportunity to differentiate within their choice.

[32] Art. 29 WP, WP 259 rev.01 (2018), p. 5; Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95; recital 44 GDPR.

[33] Recital 18 ePrivacy Regulation; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 7.

[34] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 13.

[35] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 13.

[36] Cf. recital 43 GDPR; Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95.

[37] Cf. EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 8 et seq.

[38] This follows from recital 43 GDPR and was highlighted by the EDPB in Guidelines 05/2020 on consent under Regulation 2016/679, p. 9.

[39] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 8.

[40] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 8.

[41] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 9.

[42] EDPB, Opinion 2/2017 on data processing at work, page 6 et seq.; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 9.

[43] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95.

[44] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 9.

[45] See with regard to consent within the GDPR, Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95.

[46] Recital 43 GDPR; Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95.

[47] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 10.

[48] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR)(2017), p. 95 et seq.; Golland, MMR 2018, 130.

[49] Cf. Klement, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 7, para. 56.

[50] Plath, in: Plath, DSGVO/BDSG (2018), Art. 7 para. 19 et seq.

[51] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95.

[52] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 10.

[53] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 10.

[54] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 11.

[55] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 11.

[56] Cf. EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 11.

[57] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 11.

[58] Recital 20aaaa; Recital 25 ePrivacy Directive was based on similar considerations, outlining that ‘access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose’.

[59] Recital 20aaaa.

[60] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, at rec. 37, 38.

[61] Recital 20aaaa.

[62] Cf. Frenzel, in: Paal/Pauly, DS-GVO BDSG (2018), Art. 7 rec. 21; Buchner/Kühling, in: Kühling/Buchner, DS-GVO, Art. 7 (2018) rec. 51; Wolff, in: Schantz/Wolff, Datenschutzrecht (2017), rec. 473.

[63] Recital 20aaaa.

[64] Recital 18.

[65] In this context, it is debatable how access to social networks should be classified. These are steadily gaining in importance, both in the private lives of a large part of society as well as in a professional context. Social media are frequently used for information purposes or professional/scientific exchange. In addition, businesses are increasingly using social media for marketing purposes, distribution of goods and services as well as for the acquisition of employees. However, the trend seems to be to reject social networks as essential services as for now, see Klement, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 7, para. 63.

[66] Art. 29 WP, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, WP 217, p.16; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 10.

[67] EDPB, Draft Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, p. 7; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 10.

[68] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 13.

[69] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 14.

[70] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 12; Voigt/von dem Bussche, The EU General Data Protection Regulation (2017), p. 96.

[71] Recital 32 GDPR; Voigt/von dem Bussche, The EU General Data Protection Regulation (2017), p. 96.

[72] Voigt/von dem Bussche, The EU General Data Protection Regulation (2017), p. 96.

[73] See for respective examples in the context of consent within the meaning of the GDPR Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 97; Art. 29 Working Party, WP 187 (2011), p. 18 et seq.

End-users have to be sufficiently informed in order to make an empowered decision and validly declare consent. The requirement is closely linked to the principle of transparency of data processing as per Art. 5 GDPR.^[74] Moreover, informed consent is a precondition in order to meet the requirement of specificity, as end-users can only consent to a specific purpose if they were sufficiently informed about that purpose.^[75]

Information must at the minimum contain the identity of the service providers and the intended purposes for the processing of electronic communications data.^[76] Where there are multiple entities involved, which seek to rely on consent, the information should contain the identity of all such entities.^[77] The minimum content requirements for ePrivacy consent to be sufficiently informed are

(i) the controller’s identity;

(ii) the processing purposes (if consent is obtained for more than one processing operations, the information must contain the purposes for each such operation);

(iii) the type of data collected and processed;

(iv) information about the possibilities to withdraw consent.^[78]

As regards the formal requirements for the provision of information, the GDPR does not provide for a specific form. However, information should be provided in clear and plain language that is comprehensible for the average person in order to meet the transparency requirements.^[79] According to Art. 7 Sec. 2 GDPR, where a request for consent is provided in written form it needs to be clearly distinguishable from any other matters, e.g. when the request is submitted together with a service contract and the consent declaration form. In such cases, it is advisable to graphically highlight the request for consent and the information associated with that request as well as explicitly use the term ‘consent’ in order to accomplish sufficient distinguishability.^[80] Furthermore, the relevant information required to obtain valid consent cannot be hidden behind long general terms and conditions or non-transparent and complicated privacy policies.^[81]

The responsible service or network providers are thus required to balance completeness and simplicity, which might require a case-by-case consideration with regard to the specific group of addressees. If, for example, declarations of consent are to be obtained from minors and the information is directed at minors, such information must be worded in a language understandable to minors (regarding the requirements for obtaining consent from children see Art. 4a VII.).^[82]

A declaration of consent can be sufficiently informed and, thus, valid even if the information obligations under Art. 13, 14 GDPR are not entirely fulfilled and certain information listed in Art. 13 and Art. 14 GDPR is not provided.^[83] Art. 4a Sec. 1 ePrivacy Regulation only refers to the provisions of the GDPR that concern the declaration of consent and, thus, does not explicitly refer to the general information obligations of Art. 13, 14 GDPR. This is particularly relevant for situations in which third party processors are involved (Art. 28 GDPR). The minimum information required in order to obtain informed consent includes the identity of all controllers involved, but not necessarily of all processors.^[84] The (potential) obligation to inform about the identity of involved data processors under the GDPR results exclusively from the information obligations within Art. 13 and Art. 14. In principle, it is therefore conceivable to obtain a valid declaration of consent under the ePrivacy Regulation, even if data processors are engaged which end-users have not been informed about. However, such a result seems difficult to reconcile with general data protection standards. Moreover, the ePrivacy Regulation refers to Art. 28 GDPR, at least for the design and lawfulness of data processing by third parties (Art. 6 para. 37 et seqq.). Indirectly, therefore, similar standards are likely to apply with regard to the information obligations associated with such processing.

[74] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 15.

[75] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 96.

[76] Recital 42 GDPR.

[77] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 15.

[78] In the case of declarations of consent under the GDPR, information on any automated decision-making processes (Art. 22 Sec. 2 lit. c) GDPR) and risks of data transfers due to absence of an adequacy decision (Art. 46) must also be communicated, where applicable . However, the ePrivacy Regulation does not contain any corresponding provisions or references to these regulations. Therefore, this obligation is not relevant in the context of ePrivacy consent.

[79] Art. 7 Sec. 2 GDPR; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 15.

[80] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 94; Plath, in: Plath, DSGVO/BDSG (2018), Art. 7, para. 12.

[81] Cf. EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 15.

[82] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 16.

[83] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 17.

[84] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 16; cf. Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 96.

Valid consent might be provided as an oral statement, written declaration or by electronic means, as the GDPR does not determine mandatory formal requirements.^[85] Under the GDPR, data controllers are generally free to elaborate and implement consent flow mechanisms that are suitable to their business models.^[86] The same will be applicable to service or network providers seeking to obtain consent for processing of electronic communications data in the context of the ePrivacy Regulation. However, when choosing the form of declaration of consent, the service or network providers should take into account that in case of doubt it might become necessary to prove that consent has been obtained as an unambiguous and clear affirmative act in terms of Art. 4 No.11 GDPR (regarding the burden of proof see para. 9 et seqq.; Art. 7 Sec. 1 GDPR).^[87] Consequently, it is advisable to obtain consent in an easily documentable form.^[88]

The notion ‘clear affirmative act’ requires a deliberate action by the end-user, which actively indicates a choice.^[89] The necessity to provide consent as a clear and affirmative act shall ensure that end-users are aware of the fact that and the extent to which consent is given.^[90] Therefore, any means by which consent is obtained must be suitable in order to create such awareness of the addressed end-users.

The most apparent way in of obtaining a clear and affirmative act of consent will be a letter, email or any written form of declaration by which the end-user expressly explains what she or he is agreeing to.^[91] However, in practice a clear affirmation could be provided by the following means:

(i) ticking an unticked box when visiting an internet website;

(ii) choosing technical settings (the option to provide consent by means of software settings is envisaged by Art. 4a Sec. 2 ePrivacy Regulation in the context of Art. 8 ePrivacy Regulation and linked to certain preconditions, see Art. 4a No. VI.); and

(iii) any other statement of conduct that clearly indicates acceptance of the intended processing.^[92]

Example:^[93] Swiping a bar on a screen, waiving in front of a smart camera, turning a smartphone around clockwise, or in a figure eight motion may be options to indicate agreement, as long as clear information is provided, and it is clear that the motion in question signifies agreement to a specific request (e.g. if you swipe this bar to the left, you agree to the use of information X for purpose Y.). The controller must be able to demonstrate that consent was obtained this way and data subjects must be able to withdraw consent as easily as it was given.

 Subject of dispute is the collection of consent via so-called ‘cookie banners’ as a clear and affirmative act in the online environment. Cookie banners that merely inform about the placement of cookies and do not demand an affirmative act by the end-user, but rather rely on their unopposed use of the website are insufficient for obtaining valid consent. Instead, consent has to be obtained by an active approval of the end-user.^[94] This approval has to constitute a separate act that is clearly distinguishable from other matters, such as consent to terms and conditions or subscription to newsletters.

In its Planet49 decision, the CJEU has clarified that pre-ticked boxes, so-called ‘Opt-Out’-solutions, are also insufficient to obtain valid consent in terms of the GDPR and the ePrivacy Directive.^[95] This view has now  been endorsed by the EDPB^[96] and the Federal Court of Justice of Germany.^[97] The court held that website operators necessarily need to obtain explicit consent of their end-users for the setting of non-functional^[98] cookies by means of a so-called ‘Opt-In’-declaration.^[99] The default setting relating to such cookies must be set on ‘reject’ or ‘deactivated’ when end-users access a website for the first time and non-functional cookies may only be set if and after the end-user changes this default setting manually.^[100] The CJEU has further clarified that this requirement applies regardless of whether ‘personal’ data is processed through the cookie placement or not, which is of particular relevance for the ePrivacy Regulation.^[101]

Thus, neither silence, inactivity, pre-ticked boxes, opt-out solutions nor silent proceeding with a service can be regarded as a sufficiently clear affirmative act and, thus, an active indication of choice.^[102] The technical settings of a website ought therefore be designed in a way that no data collection intended on the basis of consent is initiated until the user has actually carried out the necessary action. Whether a website operator continues to use non-compliant opt-out-procedures to obtain consent despite these developments is easily recognizable to the public and, thus, generally also for competitors and consumer protection organizations. Consequently, operators who do not implement a proper opt-in procedure expose themselves to legal consequences against them under relevant applicable Member State laws.^[103]

[85] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 94; recital 32 GDPR.

[86] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 19.

[87] Recital 32 GDPR; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 18.

[88] The EDPB even mentions recorded oral statements as permissible in principle, subject to the contract law of the Member States, but immediately notes that in this context the information provided to the data subjects must also be taken into account in a sufficient manner, EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 18.

[89] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 18.

[90] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 94; recital 42 GDPR.

[91] Cf. EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 18.

[92] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 94 et seq.; recital 32 GDPR.

[93] Drawn from EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 19.

[94] See Klement, in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht (2019), Art. 7, rec. 35.

[95] CJEU, judgement from 1 October 2020, Case C-673/17, Planet49, recs. 44-65.

[96] EDPB, Guidelines 05/2020 on consent under Regulation 2016/679 – 4 May 2020, rec. 40, 41; This view is also held by the German Federal Data Protection Conference (Datenschutzkonferenz) which took a position in this regard prior to the CJEU decision, Datenschutzkonferenz, ‘Orientierungshilfe der Aufsichtsbehörden für Anbieter von Telemedien’, March 2019, p. 8.

[97] See German Federal Court of Justice (Bundesgerichtshof), judgement from 28 May 2020 in case I ZR 7/16, para. 44 ff.

[98] However, there is no obligation to obtain consent (at all) for so-called ‘functional’ or ‘essential’ cookies. For the legal and technical differentiation between ‘functional’ (or: ‘essential’) cookies and other types of cookies see Art. 8.

[99] CJEU, judgement from 1 October 2020, Case C-673/17, Planet49, para. 63.

[100] This also results from EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 20.

[101] CJEU, judgement from 1 October 2020, Case C-673/17, Planet49, para. 66 et seq.

[102] Voigt/von dem Bussche, The EU General Data Protection Regulation (GDPR) (2017), p. 95; EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, p. 18 et seq.

[103] The German Federal Court of Justice recently referred the question to the CJEU for a preliminary ruling, whether the GDPR also provides for an abstract right of judicial action of consumer protection organisations against responsible companies, or rather whether this can be regulated nationally by Member States due to Art. 80 Sec. 2 GDPR, see German Federal Court of Justice (Bundesgerichtshof), decision from 28 May 2020 in case I ZR 186/17. According to the legal situation under the Data Protection Directive, such a right of judicial action existed, whereas the wording of the GDPR provides for this only in the event that the relevant organisations refer to a concrete infringement of a specific data subject’s rights, and not only to an abstract risk.