Swiping and scrolling is not consent, says EU data watchdog

Updated guidelines aim to address ambiguity in the application of GDPR

The European Data Protection Board (EDPB) has updated a section of the GDPR to give clearer advice around the use of consent on web pages. 

The new advice now states that scrolling or swiping through a website should not be interpreted as "consent" and can no longer be used as a signal to begin tracking user data.

The board have also provided further clarification on the validity of "cookie-walls", reiterating to companies that the use of cookie consent boxes that require a user to consent in order to view content is in breach of GDPR.

Where swiping or scrolling is concerned, the example given by the EDPB clarifies that the data controller must be able to demonstrate that consent was obtained this way and that data subjects must be able to withdraw consent as easily as it was given.

"Swiping a bar on a screen, waiving in front of a smart camera, turning a smartphone around clockwise, or in a figure-eight motion may be options to indicate agreement, as long as clear information is provided, and it is clear that the motion in question signifies agreement to a specific request (e.g. if you swipe this bar to the left, you agree to the use of information X for purpose Y. Repeat the motion to confirm.")," the guidelines state.

On the topic of cookie consent walls, the board specifically called out websites that prohibit access to content unless consent is given.

Related Resource

Don’t just collect data, innovate with it.

Removing the barriers to the experience economy

Download now

"A website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set and for what purposes data will be processed," the guidelines explain.

"There is no possibility to access the content without clicking on the 'Accept cookies' button. Since the data subject is not presented with a genuine choice, its consent is not freely given. This does not constitute valid consent, as the provision of the service relies on the data subject clicking the 'Accept cookies' button."

Although much of the guidance is already set out under GDPR, some ambiguity in the text has led to incongruity in the application of the law on websites across Europe.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Misconfigured Git servers lead to Nissan data leak
hacking

Misconfigured Git servers lead to Nissan data leak

7 Jan 2021
BackupAssist teams with Wasabi to offer cheaper backup for businesses
backup

BackupAssist teams with Wasabi to offer cheaper backup for businesses

6 Jan 2021
Data: A resource much too valuable to leave unprotected
Whitepaper

Data: A resource much too valuable to leave unprotected

2 Dec 2020
Webhose and Signal Corp boost data breach detection
Security

Webhose and Signal Corp boost data breach detection

7 Oct 2020

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021
BT faces £600m class-action lawsuit for 'overcharging'
Policy & legislation

BT faces £600m class-action lawsuit for 'overcharging'

18 Jan 2021