Why does Google require consent from users in order to process ads personalization data? Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was inadequately informed to users and did not obtain valid consent. Specifically, CNIL said Users are not able to fully understand the extent of the processing operations carried out by GOOGLE. But the processing operations are particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined. The restricted committee observes in particular that the purposes of processing are described in a too generic and vague manner, and so are the categories of data processed for these various purposes. Similarly, the information communicated is not clear enough so that the user can understand that the legal basis of processing operations for the ads personalization is the consent, and not the legitimate interest of the company. Article 6.1 of the GDPR lays out the conditions under which the processing of personal data is lawful. It seems the subparagraphs most relevant to Google's processing of personal data for the purposes of ads personalization are: 6.1.(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; 6.1.(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; 6.1.(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. It seems that the satisfaction of 6.1.(b) or 6.1.(f) would preclude the need for Google to obtain consent to process personal data. The terms under which Google processes personal data for the use of ads is stated in their Ads Data Processing Terms, with the types of personal data in scope for those terms listed here. If a user registers to Google, personally identifying their searches, are they not also agreeing to these terms, thereby satisfying 6.1.(b)? Additionally, I don't fully understand why it is not a legitimate interest for Google, an ads-serving company, to process personal data for the purpose of ads personalization?
This is a large question, so I'll only put a spotlight on some misconceptions. Why can't Google use legitimate interest instead of consent to serve ads? A data controller such as Google must choose an appropriate legal basis per Art 6(1). But if the legal basis is consent, and the data subject declines or retracts consent, you can't do the processing anyway under legitimate interest instead. It seems that the issue is not that consent was an inappropriate legal basis, but that they decided to use consent and did not collect it properly (see below). However, Google's analysis that they need consent is likely correct. There is an good argument that a website can show first-party ads under a legitimate interest. Google does so as well. But the consent in question is for ad personalization, i.e. on creating detailed profiles on users in order to show more “relevant” ads. For that purpose, Google's legitimate interest would likely not outweigh the data subject's rights and freedoms (compare Art 6(1)(f)). Why might consent be invalid? The GDPR defines consent in Art 4(11) and specifies further requirements in Art 7. The EDPB has issued guidelines 05/2020 and previously WP259 on consent. A core requirement, in addition to the general Art 5(1)(a) transparency principle, is that consent is specific and informed. The user must be informed about the specific purpose for which consent is being asked, and must be able to control consent individually for each purpose. Additionally, consent requires an affirmative action, consent is never the default. The EDPB recommends a layered information approach: in the first information layer, at the point where consent is being asked, the proposed processing activities are summarized. Full details (including all information per Art 13) are provided in a second layer that can be reached via a link. Consent will not be informed if the data subject is required to read the entire privacy policy first. How does the CNIL see Google's approach to consent and transparency? The CNIL asserts that Google failed at every step of a layered information design and failed to obtain valid consent: consent controls were hidden by default, i.e. there was no first information layer consent controls were pre-checked, thus requiring opt-out. That's not how you ask for consent (but might have been alright if Google had used legitimate interest instead). consent is all-or-nothing and not sufficiently granular Google's main information layer is its privacy policy, but it is very general and does not provide sufficiently specific information Google only provides specific information spread across further documents, often 5 or 6 levels deep Could Google rely on Art 6(1)(b) necessity for performance of a contract? If a data subject enters a contract about Google using their data for ads, yes. Otherwise, no. But in practice, necessity for a contract is very similar to consent because the data subject can freely decide whether or not to enter a contract. Even when the legal basis is a contract, the data controller still has an obligation to provide transparent information. Depending on the structure of the contract, a layered approach could be used as well. However, the purposes of processing are ultimately given by the contents of the contract. What about the Ads Data Processing Terms? These terms are not part of the terms of service or the privacy policy that end users agree to. The ads terms are instead part of their B2B offerings.
I'd say it's definitely illegal. Here's what the cookie notice says on Facebook at the time of writing this answer: By clicking on or navigating the site, you agree to allow us to collect information on and off Facebook through cookies. And here's what the GDPR define consent: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Also consider this, by the way: When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Facebook's notice is a small blue bar at the top of its blue header, and you might not even notice it (at least on a desktop computer where I'm seeing it). I see no way to easily deny consent, for example there is no button saying "I don't accept". All you can do is click on the link to their cookie policy, and still that policy does not present a clear and easy way to deny consent in all different cases, it looks pretty complicated (among other things, it depends on whether you have a Facebook account or not). So denying consent looks pretty difficult, if at all possible. On the other hand, to give consent, you'd only have to click on any link. I tried this. I opened my browser in private/incognito mode, so it should not use any previous cookies. On Google, I searched for "facebook John Doe". Clicked on a result bringing me to a Facebook page with a list of profiles of people named John Doe. The cookie bar appears at the top, but let's pretend I did not notice it. Then I click on a profile, supposing I'm interested in a certain John Doe, and... I land on John Doe's profile on Facebook, now without the cookie notice! What happened is I gave consent by clicking on any link, that is, clicking on John Doe. I can't see any way this "consent" could ever be considered "freely given, specific, informed and unambiguous indication of the data subject's wishes". Why is Facebook not compliant? Well, they probably couldn't be compliant even if they wanted to, unless they wanted to go out of business. Lately I've been wondering what the purpose of Google Analytics would be if users were always given the option to freely refuse consent. Virtually every user would always be clicking on "I don't accept", every time everywhere, so lots of business models would be totally disrupted. By the way, as of now, the cookie bar of this community (stackexchange) does not comply with GDPR either. To tell you the truth, I'm afraid very few websites have a GDPR compliant cookie notice.
european-union (germany, spain, uk) The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet this definition of consent, so any non-necessary cookies set in that context would be a violation. But it would be the national ePrivacy implementation that would be violated, not the GDPR. Thus, the GDPR's famous 4%/EUR 20M fines are not relevant here. Instead, each country can set its own fines. In Germany, this would probably be up to EUR 50k (§16 TMG) though German law doesn't implement this aspect of ePrivacy correctly. In the UK, PECR penalties are determined by more general data protection penalty legislation. Notable instances of cookie consent enforcement include the Planet 49 (ECJ judgement, German BGH verdict) case which basically affirmed that yes, the GDPR's definition of consent applies. Thus, any case law regarding GDPR consent is also applicable to the issue of cookies. Furthermore, the Spanish AEPD has issued an interesting fine due to insufficient cookie consent, but due to much more subtle violations than the outright disregard in the given example. E.g. in the Vueling action (decision (Spanish, PDF), summary, listing on enforcementtracker), the Vueling airline's website had a consent banner but ultimately told the user to reject cookies via their browser settings. This violates the requirement that consent must be specific/granular, since the browser settings are all-or-nothing if they're available at all. The airline was fined EUR 30k, the maximum possible under applicable Spanish data protection law. But what kind of risks would some blog run into that just sets cookies without appropriate consent? If the service is outside of the EU, enforcement is difficult. I am not aware of cookie consent enforcement against non-EU services. National data protection authorities can investigate the violation and issue fines, subject to their respective national data protection laws. They generally only do this when there are lots of complaints. Some authorities like the UK ICO have indicated that cookie consent enforcement isn't a priority for them. Independently, individuals can generally sue the service for damages. Some lawyers might send out cease and desist letters to non-compliant websites in the hopes of collecting fees. So aside from the last point, the risk is likely somewhat low, especially for a smaller site. At this point, it is worth reminding that ePrivacy/GDPR doesn't require consent for all cookies, and is not just limited to cookies. It is more generally about access to and storage of information on a user's device, unless that access is strictly necessary to provide the service explicitly requested by the user. Thus, functional cookies can be set without consent. However, consent does become necessary when cookies or similar mechanisms are used for analytics, tracking, or ads. Even though GDPR is involved, the cookie consent requirements apply regardless of whether the cookies involve any personal data.
Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. processing is necessary for compliance with a legal obligation to which the controller is subject. processing is necessary in order to protect the vital interests of the data subject or of another natural person. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. So unless you have some very compelling reason to need to process that person's data without their consent, you can't legally do it. Therefore it is hard to see how you could produce this "template", and even if you somehow did the person receiving it might not have a lawful basis for fetching (processing) that data anyway.
"1) Can I use an pre checked tick box under GDPR?" Nope. "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." (Recital 32) "2) Since GDPR also requires the data collector to ensure that the user is not under the age of 13 so I am planning to ask the users age only for that region i.e. EU Region. Now will simply mentioning that "By continuing you acknowledge that you are above 13 years" will work or will I have to ask the users age?" You have to require some affirmative action. Implicit consent (just continuing) is not acceptable (ibid.) "3) The GDPR requires the data collector to have a proof of the users consent. Now what kind of proof will be required for my App? I am ensuring that the user cannot move forward without providing the consent (only once) is that sufficient as a proof or is any other proof required?" If you are collecting data about the user, you should record the time and date consent was given as part of the user profile. If you are not collecting data about the user (this is only done by third party services such as Google analytics etc.) and there are no user profile, then preventing the user from using the app will have to do. The GDPR also requires data-minimization, and creating a user profile to record consent when no user profile is otherwise required will violate data-minimization-principles.
This depends on the context – GDPR rarely restricts the use of specific kinds of data (see Art 9) but instead regulates the processing of this data, and the purposes for which it is processed. Personal data is any information relating to an identifiable person (Art 4(1)). So to show that some information is not personal data, you must show either that it doesn't relate to the identifiable person, or that it's not possible to identify the person. Whether a person is identifiable depends on the means of identification that are reasonably likely to be used, taking into account the cost and effort of these means (Recital 26). This recital also mentions that singling out a person is a kind of identification. If you have lots of birthdays so that there are no unique birthdays, or if the birthdays are stored without contextual information that would allow identification, this can indicate that it's not personal data. Some examples to illustrate my views: Scenario 1: you are collecting statistical data in a shopping mall and are collecting birthdays from passer-bys, without any additional information. This information is anonymous and not personal data, since you have no reasonable means to identify the persons. Scenario 2: in an office, there's a publicly visible calendar on the wall with the birthdays of all staff members. However, the calendar doesn't say whose birthday it is. This information is likely personal data, since it's reasonably possible to infer the correct person based on contextual information. At least HR would also have the birthday for all staff members on file, so that the company clearly has the means to identify anyone. (This doesn't mean such a public calendar is illegal, just that there must be a legal basis.) It is more difficult to determine whether information also relates to an identifiable person, i.e. whether this information is about that person. This depends not just on what the information is, but how the information is used. AFAIK there has yet to be EU-wide guidance by the EDBP, but the ICO has listed some hints. I think that a birthday of an identifiable person will almost always relate to that person.
Simply use a cookie to store consent. First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie. You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website. Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate Art. 11(1) GDPR: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Notice it is possible to configure google analytics in a way so you don't need any consent. See my answer to this question. Just IP anonymization is not sufficient.
are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU? Absolutely. The territorial scope of the GDPR is specified at Article 3: Article 3 Territorial scope This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. As specified in point 1, the regulation applies to controllers and processors located in the EU. There is no exemption of personal data based on the data subject's nationality or location. In fact, GDPR Recitals 2 and 14 explicitly mention that nationality or residence shall not be a factor: The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. […]