internet european-union gdpr terms-of-service
GDPR - Confirm company terms and conditions by button click
<p>This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about conversion for a website, is it OK to let users confirm by using a button?</p>

<p>For example, like <a href="https://login.mailchimp.com/signup/" rel="nofollow noreferrer">Mailchimp</a> does:
<a href="https://i.stack.imgur.com/pTuOO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pTuOO.png" alt="enter image description here"></a></p>

<p>The basic requirements for the effectiveness of valid legal consent are defined in <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7</a> of the GDPR and specified further in <a href="https://gdpr-info.eu/recitals/no-32/" rel="nofollow noreferrer">Recital 32</a>.</p>

<p>There is no form requirement for the consent, so using a button is not a problem.</p>

<p>However, I do not think the MailChimp-button you reproduce as an example is good enough. It asks for a blanket consent to stuff that is buried in MailChimp's “Anti-spam Policy &amp; Terms of Use”.</p>

<p>But according to the GDPR, what the data subject consent to can’t be buried in the ToU – it must spelled out in clear, plain language. Requests must be <em>granular</em>, asking for separate consent for separate types of processing. “When the processing has multiple purposes, consent should be given for all of them” (Recital 32). Blanket consent, as used by MailChimp, is not allowed.</p>

<p>The other clear requirement from the GDPR is that <em>opt-in</em> is mandatory. Pre-ticked and opt-out buttons are explicitly banned: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent” (Recital 32). ‘No’ must become your data default, but if the user chooses to opt-in by clicking a button, this is valid consent. The MailChimp-button complies witrh this.</p>

<p>The GDPR also requires you to keep a records of the consents given (so make that part of the user profile), and to withdraw consent at any time &ndash; so you make make provisions for that as well in your implementation of consent.</p>

<p>A button would be the usual way of doing it. Companies more worried about proving informed consent in court if there is a dispute force you to click a box (and sometimes to open the document if they are really nervy) before you are allowed to click on the button.</p>
