The first layer of a website’s cookie banner must provide the option to close the cookie banner without giving consent.

[ctrlbrk]

Judgement published last month.

The [Austrian] Supreme Administrative Court confirmed that the first layer of a website’s cookie banner must provide the option to close the cookie banner without giving consent. This option must be visually equivalent to the option to consent.

Because of Brexit I don't know what the status of GDPR case law is like in the UK, but I don't think it would be unreasonable to think that the UK would also look at existing EU judgements.

If so, I for one, would be in breach. Fixing this is relatively straightforward for me though.

@Ozzy this may be of interest to you as well.

VwGH - Ra 2024/04/0424

The Supreme Administrative Court confirmed that the first layer of a website’s cookie banner must provide the option to close the cookie banner without giving consent. This option must be visually equivalent to the option to consent.

gdprhub.eu

 

[fisicx]

It would make the ICI in breach:

Home

ico.org.uk

That being said, If you have the right blockers in place and don't use the spyware also known as chrome you won't ever see a cookie banner (or have to accept anything).

 

[ctrlbrk]

It would make the ICI in breach:

No it wouldn't. I can't upload pics but I've just opened it and I can clearly see two options

• Accept non-essential cookies
• Reject non-essential cookies

It's right there as soon as I open the frontpage.

 

[fisicx]

You can’t close the banner without making a choice. There should be a ‘close’ label or X or whatever. At least that’s how I read the ruling.

 

[ctrlbrk]

You can’t close the banner without making a choice. There should be a ‘close’ label or X or whatever. At least that’s how I read the ruling.

There's many websites that offer two choices: Accept All and Setttings. In that case if you want to hit Reject button you have to click on Settings and then follow the instructions. These websites lack Reject in what the judgement defined as "first layer" and would be in breach, according to the judgement.

These websites (including mine) rely on users being lazy and they can't be bothered to navigate a second (or possibly a third) layer and so they end up clicking Accept All. But this is potentially a breach.

The language in the judgement also says "Regarding the design of the cookie banner the court found that Article 7(3) GDPR requires an individual case-by-case examination whether refusing consent is as simple as granting it. ", but why would I run an unnecessary risk, as opposed to taking 10 minutes to change my default configuration?


Some websites do offer a 'close' / X option which assumedly rejects all, but I don't think that's in the scope of this judgement.

 

[DontAsk]

I'm with the OP on interpretation and I would NOT assume a simple close option would be the same as respect all.

The worst example are those that you have to click to see the options and there are then 10, 20, 50... Settings that you have to scroll through and check.

 

[Ozzy]

@Ozzy this may be of interest to you as well.

I use Google's default tool that is linked to the ad/banner options on this site that gives the option to accept, reject, etc, in line with required rulings. It was the quickest and easiest option for me to setup without needing to build something bespoke

 

[ctrlbrk]

in line with required rulings.

Are you sure? The ruling says "Reject all" should be there as soon as you land on the frontpage.

I have uploaded an image - chances are it won't show but maybe you as admin should see it?

 

[antropy]

It's such a load of nonsense. I hope we get rid of the cookie law soon.

Paul.

 

[eteb3]

I don’t. I hope we refine it so it’s clear you can’t get away with “tacit acceptance that I have a legitimate interest in setting a cookie is as good as an active choice to consent to cookies”.

Cookies shape a consumer’s web experience in ways they won’t notice or understand. That’s illiberal, and anti-competitive. The principle of the law is 100% right.

 

[antropy]

The principle of the law is 100% right.

If often is. But the implementation is totally wrong.

It should be a browser setting.

Paul.

 

[dx3webs]

Using most sites is a chore now. No sooner did we get rid of popups they mandated that popups were required
An opt in or out at the browser level should be enough

 

[fisicx]

Use ghostery. Makes no difference if you agree or not, they all get blocked.

 

[antropy]

Use ghostery. Makes no difference if you agree or not, they all get blocked.

But is that what you want?

If I'm going to see ads, might as well be interesting ones.

Paul.

 

[fisicx]

But is that what you want?

If I'm going to see ads, might as well be interesting ones.

Adblockers get rid of the ads.

Makes for much nicer browsing.

 

[antropy]

Adblockers get rid of the ads.

Except that many sites are hitting back so that if they detect ad blockers they block you and then you have to disable them and reload the page etc.

Paul.

 

[fisicx]

Except that many sites are hitting back so that if they detect ad blockers they block you and then you have to disable them and reload the page etc.

TBH, most of the sites I visit don’t have a lot of adverts so it’s not really a problem.

But a couple of days ago I was trying to get some info on some local news and the site was almost impossible to use. There was more adverts on the page than actual content. Even the video clip about the incident had adverts. Truly awful experience.

 

[antropy]

But a couple of days ago I was trying to get some info on some local news and the site was almost impossible to use.

Yeah this happens a lot. Pages full of all sorts of random popups and effects. Ridiculous.

Paul.

 

[DontAsk]

Blocking breaks UKBF, at least in some browsers

 

[fisicx]

Blocking cookies or adverts or both?

It’s the tracking that’s most intrusive. The local news site I mentioned above has 29 trackers of one sort or the other. Ghostery blocks the lot. It’s almost as if these sites exist as a container for the adverts rather than being a useful source of information.

 

[ctrlbrk]

A court in Germany ruled similarly to the Austrian one in the OP.

Administrative court: Cookie banner must contain "Reject all" button

The "Accept all" button is often the standard for cookie banners. An administrative court has ruled that the opposite offer is also necessary.

www.heise.de