gdpr european-union
Do I need to track when a user declines to consent to analytics to meet GDPR?
<p>Suppose a user visits a website. They are informed that the site is using cookies and analytics, and the user can either allow cookies or decline. If the user declines (and therefore is not tracked), does the website need to collect a record that the user declined?</p>
<p>If the user previously consented and then changed their line and deconsented, this makes sense to me to record. However, if the user has never consented and I've never tracked them, do I need to record this decline somehow?</p>
<p>Recording outright declines seems to be a feature of many commercial tracker management tools like OneTrue or CookiePro, but the language is confusing if this is something a website actually <em>needs</em> to do.</p>

<p>Yes, setting a cookie to remember that cookies were declined is the most appropriate approach. No, you usually shouldn't send this info to your backend.</p>
<p>Many cookies require consent because the ePrivacy directive (closely related to the GDPR) says that you can only access information on a user device if (a) that access is strictly necessary for the service requested by the user, or (b) if the user consented to the access. Analytics are not strictly necessary in this sense, so analytics cookies always require consent.</p>
<p>When <em>declining</em> consent, the user is presumably asking to not be bothered by further consent popups for the forseeable time (e.g. 6–12 months). In fact, bothering a user on every page could be considered a dark pattern, and would call in question whether any consent given after such pestering could even be valid.</p>
<p>Thus, there is a strong argument that setting a cookie to remember “consent declined” or “consent withdrawn” is strictly necessary to perform the service requested by the user.</p>
<p>Setting a cookie is usually the least invasive way to manage consent status. For a logged-in user, storing consent status on the backend could also be very sensible. Persisting consent status about a not-logged-in user is a bit pointless, and I don't think the GDPR requires this in any case – this might even go against the data minimization principle. You don't necessarily have to record or persist consent status, but you have to be able to “demonstrate” that consent has been given if you rely on that consent. That includes demonstrating both the aspect that <em>this</em> user has given consent (which could benefit from explicit records), but also the more general aspect that this consent was obtained in a valid manner.</p>
