GDPR update: implicit consent and pre-checked boxes forbidden

GDPR: if you mentioned that term in the weeks before May 25th 2018, it triggered nervous breakdowns for many IT or marketing professionals. But since it came into effect, things have been surprisingly quiet. Until now. The EU Court of Justice recently ruled in one of the first lawsuits regarding consent within the GDPR, which changes quite a bit in how we handle GDPR. Now, what exactly is the impact of that ruling?

First of all, because of all the vagueness surrounding the topic, it’s excellent a lawsuit took place to finally clarify legislation. For example, in the Netherlands, there were contradictory statements around consent by the Dutch Government and the Privacy Authority; leaving a lot of marketers (mainly) in a situation of uncertainty. However, the new ruling provides exactly the clarity many are searching after; even though some might argue that it is further limiting the work of marketers. For the end-user though, it’s very much in favour of privacy.

The ruling

In short, the ruling states:

• implicit consent is not allowed as a method to get (cookie) consent, (implicit consent means ‘if you continue using this website, we will register that as your consent’);
• pre-checked boxes, even on a cookie bar settings page, are not allowed;
• all consent to advertising or personalisation related cookies needs to be acquired through an explicit action, like checking a box or actively clicking an ‘I accept’ button or both.

So, for the activation of all marketing tags, an explicit user action is required, like checking a box or pressing an ‘I accept’ button. This probably means you will need to update your cookie bar.

An interesting detail is that you are not required to get consent through checkboxes. If in your cookie bar, you clearly describe that after the users’ consent, you place cookies for advertising or personalisation purposes, the click on an ‘I accept’ button is enough. As long as you also provide an ‘I do not accept’ option.

Impact on marketing

Most cookie bars now follow the implicit consent principle, which delivers many users to your (re)marketing audiences. Complying with this new ruling will significantly impact the volumes of users that will flow into your marketing campaigns because you depend on the explicit action.

If you update your cookie bar, we suggest making it informative. However, you should pay attention to how you can facilitate users into making a quick yes or no choice of their liking. In the Netherlands, the nos.nl site is an excellent example of an informative, user-friendly and functional cookie bar.

The cookie is not dead. Yet.

Together with the developments around Intelligent Tracking Prevention, the new ruling is a big step towards a cookieless world. It’s a new reality. Even companies like Google and Facebook do not yet have a solution to this situation; besides that they acknowledge it.

The cookie isn’t dead, yet. But from a marketing perspective, it is wise to start shifting focus from gaining and targeting new or unknown users, to better servicing your existing users or clients with your first-party data. That, in the end, is also the purpose of both these legislative and technical developments: protect the privacy of your users and shift focus to helping the people that make themselves known to you. It might feel like a different of even more complicated way of doing business and marketing. Then again, putting the clients’ needs first should always be a primary goal.

Now what?

In short, our advice is to do three things:

• update your cookie bar to make it GDPR compliant to the new ruling;
• audit and if necessary update your marketing tag setup, so that for example your remarketing tags only fire after the new explicit consent;
• think about how this impacts your marketing strategy and how you can improve the use of your first-party data.

So, the first two tips are what you can do now, whereas the third is more strategic considering long term actions.

Please note that this article is advisory only. Even though we’re happy to help, further advice would always be to involve your legal counsel as a company. This way, you’re sure how to decide what actions you should take.

So, let’s get to work, and let’s find the potential in this new digital reality!