internet gdpr privacy netherlands
Do I need &quot;cookie management modal&quot; in my web application?
<p>We have a web application (+1000 users) and we use analytics cookies and have also some cookies that are required for the application to work.</p>
<p>Before the user creates an account, it has to accept both &quot;Terms of use&quot; and &quot;Privacy policy&quot; that we provide in the registration screen.</p>
<p>If the user accesses the application landing-page (not the app itself), we do show the cookie modal to ask for consent and etc.</p>
<p>My question is if we do need to have this modal for consent inside the application (after login) even if the user already has agreed with stuff on account creation?</p>

<p>To the extent that you deem consent necessary then it must be specific to the use of cookies. <a href="https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf" rel="nofollow noreferrer">C-673/17</a> primarily dealt with a pre-selected checkbox but the court specified that a general consent to participate in a lottery was not enough to infer consent to the use of non-essential cookies.</p>
<p>At the same time, it is not always necessary to ask consent to use cookies. As detailed by the <a href="https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/normuitleg_ap_cookiewalls.pdf" rel="nofollow noreferrer">Dutch Data Privacy Authority</a> cookies that are strictly necessary to provide a service and some analytics cookies may be used without explicit consent. It goes on to explain that a “cookie wall” (blocking the use of a service unless you agree to non-essential cookies) vitiates consent. Forcing users to agree to all terms and conditions with no possibility to register without “consenting” to non-essential cookies would violate this principle.</p>
<p>Either way, agreement to general terms and conditions is not a proper basis to use cookies and there is no reason to treat registered and unregistered users differently in this respect (which is not to say that you always need a modal). Note that you are also allowed to use cookies to store cookie preferences across visits.</p>
<p>Also interesting: <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf" rel="nofollow noreferrer">Article 29 working party guidelines on consent</a>. This is about the GDPR but the ePrivacy directive refers to the — repealed — directive 95/46 it replaces, cf. article 94 of regulation 2016/679 and article 2(f) of directive  2002/58/EC.</p>

<p>You must obtain consent for using any cookies that are not strictly necessary to perform the service requested by the user. This stems from the ePrivacy directive, respectively your country's implementation of this directive. Consent is currently defined by the GDPR. It does not matter whether the cookies actually involve personal data.</p>
<p>Cookies that are necessary for the application to work (e.g. session cookies, authorizations, preferences, shopping cart contents) are likely strictly necessary. They pose no problem, although you should provide transparent information about the use of these cookies in your privacy policy.</p>
<p>Analytics are not strictly necessary. Before using cookies or similar technologies for analytics, you will need to obtain consent.</p>
<p>“Consent” under the GDPR has fairly high requirements. It requires that the user has made a conscious decision, that they made the decision freely and informed, and that they can give/withhold consent for specific purposes – bundling is not allowed.</p>
<ul>
<li><p>The user must indicate their consent through a clear statement or affirmative action, e.g. clicking a button or ticking a checkbox. This indication of consent must be unambiguous. Agreement to your terms of service or to your privacy policy cannot be GDPR consent for anything mentioned in these documents because you cannot be sure that the user intended to give consent also for those purposes. Consent should never be bundled with other documents, but should be clearly separated from other matters.</p>
</li>
<li><p>You cannot bundle consent. When you ask for consent for different purposes, the user must be able to give consent to one but withhold consent for another. This is another reason why agreement to a privacy policy cannot constitute consent.</p>
</li>
<li><p>You cannot make a service conditional on unrelated consent. Users must be able to use your application without giving consent to analytics cookies. Of course, it is possible to make a service conditional on related consent, e.g. of course a videoconferencing system can only work if the users gives consent to access camera/microphone.</p>
</li>
<li><p>Consent must be informed. The user must actually understand what they are consenting to. Typical privacy policies are far too long and complex to expect anyone to actually read them. Instead, you should use a layered approach: when asking for consent you should describe the key aspects of what the user would be consenting to, and link to your privacy policy for the full details.</p>
</li>
</ul>
<p>If you do not collect valid consent, the resulting processing activities are illegal. You as the data controller must be able to demonstrate that valid consent was obtained. This is often interpreted to mean that you must store a record that registers the consent event for later audit. I think it is more important to ensure that your consent flow is demonstrably GDPR-compliant, in particular that you can show that users' consent is informed and freely given.</p>
<p>I therefore think that you will have to show your cookie dialog within your app as well. You should not set or access analytics cookies until such consent has been given. You cannot assume that consent has been given by default: consent is opt-in, not opt-out.</p>
<p>Sources:</p>
<ul>
<li>Cookie consent is required by <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219" rel="nofollow noreferrer">ePrivacy</a> Art 5(3), where cookies correspond to “information […] in the terminal equipment of a subscriber or user”. Exempted from the consent requirement are cookies that are technologically necessary, and access “as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”. National law must provide equivalent conditions.</li>
<li>Consent is defined in <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">GDPR Art 4(11)</a> and applies for cookie consent per ePrivacy Art 2(f) in conjunction with GDPR Art 94.</li>
<li>Conditions for consent are expanded in <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">GDPR Art 7</a>.</li>
<li>The EDPB has endorsed <a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227" rel="nofollow noreferrer">guidelines on transparency</a>, which suggest a layered information approach rather than expecting users to read the entire privacy policy.</li>
<li>The EDPB has issued <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en" rel="nofollow noreferrer">guidelines on consent</a>.</li>
</ul>
