gdpr
Is &quot;By clicking Continue you accept T&amp;C&quot; an unambiguous consent in context of GDPR
<p>I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to that "Continue" button there is a text "By clicking Continue you accept Terms &amp; Conditions" with link to those T&amp;C - the link leads to a web page which presents T&amp;C.</p>

<p><strong>It this text along with link considered a valid GDPR unambiguous consent?</strong></p>

<p>The form looks like this:</p>

<pre><code>[boring payment form, name, credit card, CVV, email]
[text "By clicking BUY I confirm I have read &amp; accept T&amp;C"]
[link to general company T&amp;C]
[link to mobile app T&amp;C]
[link to privacy policy]
[BUY button]
</code></pre>

<p>An example of such "handling of consent" is what my Firefox just opened me as home page after updating it:
<a href="https://i.stack.imgur.com/wHU0X.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wHU0X.png" alt="enter image description here"></a></p>

<p>it links to <a href="https://accounts.firefox.com/legal/terms" rel="nofollow noreferrer">https://accounts.firefox.com/legal/terms</a> and <a href="https://accounts.firefox.com/legal/privacy" rel="nofollow noreferrer">https://accounts.firefox.com/legal/privacy</a>.</p>

<p>It almost certainly satisfies "unambiguous" (it isn't an opt-out).  </p>

<p>But it may not be intended to be GDPR consent: "consent" is only one of the (six?) grounds for lawfully processing personal data; others included "technically necessary to provide the service".  Amongst other things, this means that a payment form doesn't need GDPR consent to process your credit card number; it is absolutely fundamental to what the form is trying to do.</p>

<p>If the form <em>is</em> trying to obtain GDPR consent, then it may well not work.  Firstly, hiding the T&amp;Cs behind a link probably doesn't cut it; secondly, refusing to provide an unrelated service (which is what the "Continue" <em>may</em> be doing) if the user doesn't grant consent is outlawed too.</p>

<p>Not giving a picture of the page makes it more difficult, but this method arguably violates multiple <a href="https://medium.com/@sagarag/how-to-design-gdpr-compliant-consent-b5d6cf28d0c5" rel="nofollow noreferrer">guidelines</a> of GDPR consent:</p>

<p><strong>Active opt-on</strong> <em>Consent requires a positive opt-in and avoid pre-ticked boxes or any other method of consent by default.</em> </p>

<p><strong>Unbundled</strong> </p>

<p><strong>Granular</strong> </p>

<p>I.e. consent is given by giving consent, not by doing something else. Anything that says "By doing X, you are giving consent" is highly suspect.</p>

<p>Consent should be given in an action that does nothing but give consent. Any action that performs some action in addition to giving consent runs the risk of being considered "ambiguous", as a person can claim that they didn't notice the consent part, and thought they were just performing the other action.</p>
