Probably not.
A data subject’s consent to the use of analytics or behavioural cookies must be a valid “affirmative act.” While it may be argued that the data subject is indeed performing an “affirmative act” by continuing to utilize the website after being advised of the use of cookies, this likely is not sufficient according to current guidance. Specifically, the United Kingdom’s Information Commissioner’s Office has implied that conditioning use of a website on the data subject’s consent would render the consent invalid. The ICO states that an organization must “provide users with controls over any non-essential cookies, and still allow users access to [the] website if they don’t consent to these cookies.”[1]
The reasoning underlying this requirement is premised on the concept that consent must be “freely given” to be valid. Because the data flow outlined above offers the data subject a “take it or leave it” proposition—that is, either accept analytics and behavioural cookies or do not use the website—the “consent” from the data subject in continuing to use the website is not “freely given” and therefore not valid.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
(at p.11).
[View source.]
