Yes.
Most cookie banners can be classified into one of three general categories: (1) notice only banners, (2) notice + opt-out banners, and (3) notice + opt-in banners. If a company chooses to adopt a cookie banner that provides notice and solicits the opt-in consent (e.g., “I agree”) of website users, the company would have a strong argument that it does not need to disclose that it has sold information, does not need to forward deletion requests to the providers of its third party cookies, and does not need to include an “opt out of sale” link on its website.1
Companies often struggle with anticipating the percentage of users that are likely to accept the deployment of cookies when prompted. There is relatively little empirical data publicly available concerning website visitors’ interactions with cookie banners. The little data that does exist, however, indicates that user acceptance rates are significantly greater depending upon how many options are presented to a website visitor. For example, in one study, researchers placed a cookie banner on a website that provided only two options – accept or reject cookies.2 They then placed a cookie banner on the same website that presented users with the ability to accept cookie deployment for specific third parties (e.g., Facebook, YouTube, Google, etc.). They found that 20.9% of people that visited the website from a computer accepted the binary option, whereas less than 1% accepted cookies when presented with multiple options.3
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. Cal. Civil Code 1798.108(c); 1798.115(c)(1); 1798.140(t)(1), (2)(A).
2. Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz, 2019, (Un)informed Consent: Studying GDPR Consent Notices in the Field available at https://arxiv.org/pdf/1909.02638.pdf.
3. Id. at 9.
[View source.]
