privacy gdpr website
Opting out of cookies by emailing a company
<p>Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than offering a technical solution to prevent them from setting those cookies.</p>

<p>Firstly, let us assume that if you were to email them, they would instruct you to change your browser settings to block 3rd-party cookies.</p>

<p>As a second variant, let us assume that they would instruct you to disable all cookies, but that this would break minor functionalities of the site.</p>

<p>In principle, using email as an opt-out mechanism could be ok, at least in theory. But I see three issues with this:</p>

<ul>
<li><p>A website visitor might not have an email address, yet the data controller is still required to honour the data subject's rights. (This might be far-fetched, but edge cases are interesting.)</p></li>
<li><p>The GDPR allows opt-out when the processing is based on <em>legitimate interest</em>. However, <em>consent</em> always required opt-in. While the processing of data for analytics purposes might be covered by legitimate interest as far as the GDPR is concerned, the GDPR is not the only applicable EU law here: ePrivacy requires consent for all non-essential cookies and related techniques. Thus, any opt out solution for cookies is invalid.</p>

<p>What if the cookies are only set when the visitor consents on the website, but the visitor would have to write an email when they want to <em>withdraw</em> consent? That would be invalid, because consent must be as easy to withdraw as it is to give content.</p></li>
<li><p>Removing cookies through an email is technically impossible, unless the visitor has registered for a user account on the website with their email address. The reason is that cookies are stored on the visitor's device. The website has to abstain from setting new cookies in that user's browser, and has to delete existing cookies. But the website needs to know which visitor opted out – without a log-in there's no connection from the email address to the visitor's session on the website.</p></li>
</ul>

<p>So all in all, this email-driven opt-out sounds like a really bad idea.</p>

<p>What about opting out from cookies by disabling all cookies in the browser? This is a problematic and disproportionate approach, as it would also break other sites. More importantly, some browsers do not support such fine-grained cookie controls, e.g. apps that use Android WebView. The website operator cannot get out of their data controller obligations by blaming the user's browser.</p>

<p>No, this <a href="https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/" rel="nofollow noreferrer">would not be legal under PECR</a> as it requires consent from the user (although it may depend on the laws of the country where the company is situated if they're applied or not):</p>
<blockquote>
<p><strong>What do we need to do to comply?</strong></p>
<p>The rules on cookies are in
regulation 6. The basic rule is that you must:</p>
<ul>
<li>tell people the cookies are there;</li>
<li>explain what the cookies are doing
and why;</li>
<li><em>and get the person’s consent to store a cookie on their
device</em>.</li>
</ul>
<p>As long as you do this the first time you set cookies, you do
not have to repeat it every time the same person visits your website.
However, bear in mind that devices may be used by different people. If
there is likely to be more than one user, you may want to consider
repeating this process at suitable intervals.</p>
<p>You may also need to obtain fresh consent if your use of cookies
changes over time.</p>
</blockquote>
<p>When the ePrivacy Regulation is finally published, this may change.</p>
