1.1 Freely Given
This component of legitimate cookie consent signifies actual choice and control for consumers. The GDPR makes it clear that if a user is denied real choice, feels coerced, or will experience adverse results for failing to provide consent, then the consent given in these circumstances is invalid.
Similarly, if cookie consent is sought through bundling as one of the elements of non-negotiable terms and conditions, then it is not considered freely authorized.
Another circumstance under which cookie consent is considered not freely given is when a data subject is denied the opportunity to withdraw their consent without consequences.
The GDPR also makes it clear that any component of undue pressure or influence on the data subject that restricts a user from exercising their free will makes any consent provided under these circumstances non-compliant with the requirements of this data privacy law.
The different elements of inappropriate pressure or influence on users that deny the opportunity to exercise free will include;
- Imbalance of power
- Conditionality
- Granularity
- Detriment
1.1.1 Imbalance of Power
The GDPR takes into account the idea of the existence of an imbalance between the controller and the user.
Essentially, this data protection law acknowledges that if the controller is a public authority, it is highly probable that the body will depend on consent for processing consumer data.
Another key aspect to take into account in this context is the fact that in most instances, the user will not have viable alternatives to agreeing to the controller’s terms of data processing.
Another scenario where the aspect of a power imbalance can emerge between data subjects and the controller is in the employment context.
Granted the dependency that is typical of the employer/employee relationship, it is unexpected that the employee can refuse to provide consent to the employer for the processing of his/her personal information without being concerned about getting punished for the denial of consent.
For instance, it is improbable that a member of staff can deny consent freely to his/her employer for activities such as installing surveillance systems such as camera monitoring at work.
As such, the EDPB acknowledges the use of consent to process existing and future workers’ information as being complicated because consent is unlikely to be granted freely.
For this reason, the EU data protection body clarifies that for a big percentage of this kind of data processing in the workplace, the legal basis cannot and should not be the consent of the employees due to the nature of the employer/employee relationship.
Nonetheless, this provision does not imply that the use of employee consent as the basis of processing personal information should be avoided entirely by employers since specific circumstances can provide the conditions for employers to show that consent was granted freely.
Consider a scenario where a film crew is contracted to film a specific section of the workplace, and the employer requests all employees whose workstation is on the section to be filmed to give consent for this purpose, since they may form part of the background in the video. The employer can demonstrate freely given consent by not penalizing the members who do not want to be filmed in any way and offering them similar workstations in another part of the office space until the completion of the filming process.
1.1.2 Conditionality
Article 7(4) of the GDPR invalidates the bundling of consent with the acceptance of terms or conditions.
Similarly, the law also prohibits tying the provision of another contract or service that is unnecessary for the execution of the main service offered to a consent request to enable the processing of personal information.
The consent granted in such circumstances cannot be considered freely given.
To illustrate these perspectives, the case of a smartphone application for editing images that require users to have their GPS localization turned on to use its services can be used.
It is important to note that this app also informs its customers that the information being collected will be utilized for behavioral advertising reasons.
However, both geolocalization and digital behavioral advertising are not necessary for the delivery of the image editing service, which means that they exceed the provision of the core service offered to users.
The EDPB clarifies that since data subjects cannot utilize the app without providing consent to these purposes, the consent cannot be regarded as given freely.
For consent to be considered freely given, users must be allowed access to services and functionalities without being subjected to a conditional agreement to the storage of data, or access to information held in their terminal device.
This conditional consent request is commonly referred to as a cookie wall.
1.1.3 Granularity
In specific settings, it happens that a service entails several processing activities for more than a singular purpose.
In these situations, users should be granted the freedom to select the purpose they consent to, instead of having to agree to a set of processing purposes.
Consequently, consent is determined to be not freely granted in case the process of seeking consent omits the freedom for users to provide separate consent for personal information processing purposes.
The EDPB clarifies that if a controller combines various purposes for processing and failed to make any efforts to seek separate consent for every purpose, it denies users freedom.
Since the GDPR requires consent to be specific, the granularity requirement ensures that valid consent is obtained in instances where data processing is performed in the fulfillment of various purposes.
For example, a business can request consumers to provide consent for the use of their data for the purpose of receiving marketing emails and also the dissemination of their data to partner third-parties.
In such a scenario, consent is deemed as not being granular because there are no separate consents for the twin purposes, hence invalid.
1.1.4 Detriment
The EU’s data privacy law obliges businesses to show that it is possible to deny or withdraw consent without negative consequences.
For instance, controllers should demonstrate that withdrawing consent does not result in any adverse consequences for the data subject.
Other aspects of detriment comprise deception, intimidation, coercion, or notable adverse effects if a user fails to give consent.
Therefore, if the data controller can demonstrate that the service comes with the option to withdraw consent without any negative consequences such as the delivery of the service being downgraded to the detriment of the consumer, consent can be deemed to have been freely given.
